VDB

CVE-2021-22878

CVE-2021-22878 PUBLISHED CVSS 4.800000190734863 MEDIUM

Nextcloud Server prior to 20.0.6 is vulnerable to reflected cross-site scripting (XSS) due to lack of sanitization in `OC.Notification.show`.

EPSS 1.06% · 64.2th percentile

Risk Scores

CVSS 3.1
4.800000190734863
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS Score
1.06%
64.2th percentile

Affected Products

VendorProductVersions
nextcloudnextcloud_server0
fedoraprojectfedora34
n/aNextcloud ServerFixed in 20.0.6

Timeline

  • CVE Published
  • Mar 1, 2021 PoC Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 26, 2021 EPSS Score
  • Dec 30, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Mar 4, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 6, 2022 EPSS Score
  • Sep 10, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›