CVE-2020-8294: XSS
Published Feb 3, 2021
·Updated
A missing link validation in Nextcloud Server before 20.0.2, 19.0.5, 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.
Affected Software
3 affected components
Nextcloud Server<18.0.11
Nextcloud Server>=19.0.0<19.0.5
Nextcloud Server>=20.0.0<20.0.2
Event History
Feb 3, 2021
CVE Published
via MITRE·04:42 PM
Data Sourced
via MITRE·04:42 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2020-8294?
CVE-2020-8294 is classified as a medium severity vulnerability due to its potential for executing stored XSS attacks.
2
How do I fix CVE-2020-8294?
To fix CVE-2020-8294, update your Nextcloud Server to version 20.0.2 or later, 19.0.5 or later, or 18.0.11 or later.
3
Which versions are affected by CVE-2020-8294?
CVE-2020-8294 affects Nextcloud Server versions prior to 20.0.2, 19.0.5, and 18.0.11.
4
What type of attack does CVE-2020-8294 enable?
CVE-2020-8294 enables the execution of stored cross-site scripting (XSS) attacks using Internet Explorer.
5
Is CVE-2020-8294 a critical vulnerability?
No, CVE-2020-8294 is not classified as a critical vulnerability, but it can still pose risks to user data and application integrity.