CVE-2019-15619

low-risk
Published 2020-02-04

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.

Do I need to act?

-
0.25% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.8/10 Medium
NETWORK / LOW complexity

Affected Products (3)

Deck

Affected Vendors

Nextcloud

References (8)

Permissions Required https://hackerone.com/reports/662204
Vendor Advisory https://nextcloud.com/security/advisory/?id=NC-SA-2020-008
Vendor Advisory https://nextcloud.com/security/advisory/?id=NC-SA-2020-009
Vendor Advisory https://nextcloud.com/security/advisory/?id=NC-SA-2020-010
Permissions Required https://hackerone.com/reports/662204
Vendor Advisory https://nextcloud.com/security/advisory/?id=NC-SA-2020-008
Vendor Advisory https://nextcloud.com/security/advisory/?id=NC-SA-2020-009
Vendor Advisory https://nextcloud.com/security/advisory/?id=NC-SA-2020-010
29
/ 100
low-risk
Severity 19/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 9/34 · Low