medium4.8
CVE-2019-15618
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
Impact
Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nextcloud | Nextcloud Server | before 14.0.9 from 15.0.0 before 15.0.6 |