๐ Nextcloud: XSS in Desktop Client in call notification popup
๐ก Newskategorie: Sicherheitslรผcken
๐ Quelle: vulners.com
Summary: The Nextcloud Desktop Client application does not properly neutralize the name of a group conversation before using it. Steps To Reproduce: Server Machine: Install the Nextcloud Server application Create an administrator account Create a user account Client Machine: Install the Nextcloud Desktop Client application on a machine that is running the Windows 10 operating system Log in to the user account Server Machine: Log in to the administrator account Install the Nextcloud Talk application Open the Nextcloud Talk application Create a group conversation with the name <img src="https://avatars.githubusercontent.com/u/99037623"> Add the user to the group conversation Start a call in the group conversation Client Machine: Observe that the name of the group conversation is treated as HyperText Markup Language Please do note that group conversation messages are also treated as HyperText Markup Language. Supporting Material/References: {F1953705} {F1953706} {F1953851} Impact An attacker can inject arbitrary HyperText Markup Language in to the Nextcloud Desktop Client... ...