CVE-2016-9466: XSS
Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message, this led to a reflected Cross-Site-Scripting vulnerability.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9466?
CVE-2016-9466 is classified as a medium severity vulnerability due to the potential for reflected XSS attacks.
How do I fix CVE-2016-9466?
To fix CVE-2016-9466, upgrade to Nextcloud Server version 10.0.1 or ownCloud Server versions 9.0.6 or 9.1.2 or later.
What applications are affected by CVE-2016-9466?
CVE-2016-9466 affects Nextcloud Server versions before 10.0.1 and ownCloud Server versions before 9.0.6 and 9.1.2.
What type of vulnerability is CVE-2016-9466?
CVE-2016-9466 is a reflected cross-site scripting (XSS) vulnerability in the Gallery application.
What causes CVE-2016-9466?
CVE-2016-9466 is caused by improper sanitization of exception messages in the Gallery application, allowing attackers to manipulate error messages.