CVSS 3.1 Score 5.4 of 10 (medium)


Published Nov 21, 2023
Updated: Nov 30, 2023


CVE-2023-48302 is a vulnerability that affects Nextcloud Server, an open source cloud platform. Versions 25.0.0 and earlier, including Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3, are vulnerable to a cross-site scripting (XSS) attack when a user copies and pastes HTML code without markup using Ctrl+Shift+V, causing the markup to render unintentionally. The issue has been fixed in Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3. As a workaround, users can disable the app text feature to mitigate the vulnerability's impact on their organization's security. This vulnerability has a base severity rating of MEDIUM and poses a potential danger to organizations as it allows an attacker to execute malicious scripts within the context of the affected user's browser session, potentially leading to unauthorized access or data theft.

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2023-48302 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options