CVE-2023-23942

NameCVE-2023-23942
DescriptionThe Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nextcloud-desktop (PTS)buster, buster (security)2.5.1-3+deb10u2vulnerable
bullseye (security), bullseye3.1.1-2+deb11u1vulnerable
bookworm3.7.3-1+deb12u1fixed
sid3.11.0-1.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nextcloud-desktopsource(unstable)3.6.4-1

Notes

[bullseye] - nextcloud-desktop <no-dsa> (Minor issue)
[buster] - nextcloud-desktop <no-dsa> (Minor issue)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-64qc-vf6v-8xgg
https://github.com/nextcloud/desktop/pull/5233
https://github.com/nextcloud/desktop/pull/5240
https://hackerone.com/reports/1788598

Search for package or bug name: Reporting problems