CVE-2021-32782: Cross-Site Scripting in Nextcloud Circles

First published: Tue Sep 07 2021(Updated: )

Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles application is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Circles application is upgraded to 0.21.3, 0.20.10 or 0.19.14 to resolve this issue. As a workaround users may use a browser that has support for Content-Security-Policy. A notable exemption is Internet Explorer which does not support CSP properly.

Credit: security-advisories@github.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/nvd-index
• agent/type
• agent/remedy
• agent/softwarecombine
• collector/mitre-cve
• source/MITRE
• agent/author
• agent/references
• agent/title
• agent/last-modified-date
• agent/weakness
• agent/severity
• agent/description
• agent/first-publish-date
• agent/event
• agent/tags
• vendor/nextcloud
• canonical/nextcloud circles
• version/nextcloud circles/0.20.0
• version/nextcloud circles/0.21.0