CVE-2021-32782: Cross-Site Scripting in Nextcloud Circles
Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-32782?
CVE-2021-32782 is classified as a medium severity vulnerability due to its potential for exploitation via stored Cross-Site Scripting (XSS).
How do I fix CVE-2021-32782?
To fix CVE-2021-32782, upgrade to Nextcloud Circles version 0.19.14 or later, 0.20.10 or later, or 0.21.3 or later.
Which versions of Nextcloud Circles are affected by CVE-2021-32782?
Nextcloud Circles versions prior to 0.19.14, as well as versions between 0.20.0 and 0.20.10, and between 0.21.0 and 0.21.3 are affected by CVE-2021-32782.
What kind of vulnerability is CVE-2021-32782?
CVE-2021-32782 is a stored Cross-Site Scripting (XSS) vulnerability, allowing attackers to inject malicious scripts into web pages viewed by other users.
What is the impact of CVE-2021-32782?
The impact of CVE-2021-32782 includes the potential for attackers to execute arbitrary scripts in the context of a user's browser, compromising user interactions and data.