CVE-2023-48302
CVSS 3.1 Score 5.4 of 10 (medium)
Details
Summary
CVE-2023-48302 is a vulnerability that affects Nextcloud Server, an open source cloud platform. Versions 25.0.0 and earlier, including Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3, are vulnerable to a cross-site scripting (XSS) attack when a user copies and pastes HTML code without markup using Ctrl+Shift+V, causing the markup to render unintentionally. The issue has been fixed in Nextcloud Server and Nextcloud Enterprise Server versions 25.0.13, 26.0.8, and 27.1.3. As a workaround, users can disable the app text feature to mitigate the vulnerability's impact on their organization's security. This vulnerability has a base severity rating of MEDIUM and poses a potential danger to organizations as it allows an attacker to execute malicious scripts within the context of the affected user's browser session, potentially leading to unauthorized access or data theft.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions