CVE-2018-3764
Medium
Description
In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.
SeverityMedium
CVSS4.8
Exploit probability—
Product
Nextcloud Contacts
PublishedJul 5, 2018
First seenJul 5, 2018
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- nextcloud contacts2.1.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nextcloud contacts | v < 2.1.2 | 2.1.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.