CVE-2018-3763 In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only af...
MediumCVSS 4.8
EPSS 0.61%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Nextcloud calendar | < 1.5.8 | 1.5.8 |
| Nextcloud calendar | = 1.6.0 | No fix listed |
| Nextcloud Calendar application | = <1.6.1, <1.5.8 | No fix listed |
References
- nextcloud.com broken-link vendor-advisory