CVE-2017-0893: XSS
Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2. Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-0893?
CVE-2017-0893 is classified as a medium severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.
How do I fix CVE-2017-0893?
To fix CVE-2017-0893, upgrade Nextcloud Server to version 9.0.58 or later, or versions 10.0.5 or later, or 11.0.3 or later.
Which versions of Nextcloud Server are affected by CVE-2017-0893?
CVE-2017-0893 affects Nextcloud Server versions prior to 9.0.58, 10.0.5, and 11.0.3.
What type of vulnerability is CVE-2017-0893?
CVE-2017-0893 is a cross-site scripting (XSS) vulnerability that arises from the use of a vulnerable JavaScript library.
Can CVE-2017-0893 be exploited in all browsers?
CVE-2017-0893 primarily affects users of Safari 10.1 and 10.2 due to a specific behavior change in these versions.