CVE-2018-3764 In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected gro...
MediumCVSS 4.8
EPSS 0.64%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Nextcloud contacts | < 2.1.2 | 2.1.2 |
| Nextcloud Contacts application | = <2.1.2 | No fix listed |
References
- nextcloud.com vendor-advisory