CVE-2023-48302: Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+V
Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, when a user is tricked into copy pasting HTML code without markup (Ctrl+Shift+V) the markup will actually render. Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3 contain a fix for this issue. As a workaround, disable app text.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-48302?
CVE-2023-48302 is a vulnerability in Nextcloud Server that allows for Self XSS when pasting HTML into the Text app with Ctrl+Shift+V.
Which versions of Nextcloud Server are affected by CVE-2023-48302?
Versions 25.0.0 to 25.0.13, 26.0.0 to 26.0.8, and 27.0.0 to 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server are affected by CVE-2023-48302.
What is the severity of CVE-2023-48302?
The severity of CVE-2023-48302 is medium, with a CVSS score of 5.4.
How can I fix CVE-2023-48302?
To fix CVE-2023-48302, update Nextcloud Server or Nextcloud Enterprise Server to versions 25.0.13, 26.0.8, or 27.1.3 or later.
Where can I find more information about CVE-2023-48302?
You can find more information about CVE-2023-48302 in the Nextcloud Server security advisory on GitHub and the associated pull request for the Text app.