地图 / XSS in Desktop Client via user status and information

XSS in Desktop Client via user status and information

注入与走私 / 资源注入 / #1707977

厂商: Nextcloud
严重程度: 低危 · CVSS 3.5
赏金: —
弱点: 资源注入
研究员: @b911bade858ce8e6a0f50f8
披露日期: 2022-11-25
资产: Desktop Client
CVE: CVE-2022-39332

该报告还没有中文解读。

原文摘录

摘自原文（1026 字符中的一小部分）

Summary: The `Nextcloud Desktop Client` application does not properly neutralize the `Full Name` and `Status Message` of users before using them.

默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Nextcloud 所有。

时间线

2022-09-21报告提交
2022-11-25公开披露

阅读 HackerOne 原文 ↗作者 @b911bade858ce8e6a0f50f8 · 版权归作者与 Nextcloud 所有

同类报告

Arbitrary local system file read on open-xchange serverOpen-Xchange · — · $2,000 Nextcloud Desktop Client RCE via malicious URI schemesNextcloud · 2021-04-15 · $1,000 [Xenoblade Chronicles X: Definitive Edition] Unrestricted RPCs allow DoS and writing arbitrary flags remotelyNintendo · 2025-05-15 HTML injection possible with soft email confirmations when Administrator manually confirms attacker email addressGitLab · 2024-10-08 · $1,060 Content injection in Jira issue title enabling sending arbitrary POST request as victimGitLab · 2022-09-22 Arbitrary POST request as victim user from HTML injection in Jupyter notebooksGitLab · 2022-05-20