Cross-Site Scripting in nextcloud-vue-collections

published 2020-09-04 6y ago modified 2021-10-04 5y ago

cvss: —; not scored
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

Versions of `nextcloud-vue-collections` prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS). The `v-tooltip` component has an insecure `defaultHTML` configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim's browser.

## Recommendation

Upgrade to version 0.4.2 or later.

Patch / fix

fixed in 1 links 1

npm nextcloud-vue-collections 0.4.2

github.com/juliushaertl/nextcloud-vue-collections@8ec1fca commit

Is GHSA-whv6-rj84-2vh2 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Affected packages

ecosystem	package	affected	fixed in
npm	nextcloud-vue-collections	<0.4.2	0.4.2

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

GitHub Advisory GHSA-whv6-rj84-2vh2

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.