Advisories » MGASA-2018-0394

Updated nextcloud packages fix security vulnerability

Publication date: 14 Oct 2018
Modification date: 17 Feb 2022
Type: security
Affected Mageia releases : 6
CVE: CVE-2018-3780

Description

Nextcloud has been updated to 13.0.6 and fixes at least the following
security issue:

A missing sanitization of search results for an autocomplete field could
lead to a stored XSS requiring user-interaction. The missing sanitization
only affected user names, hence malicious search results could only be
crafted by authenticated users (CVE-2018-3780).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=23497
• https://nextcloud.com/changelog/#latest13
• https://nextcloud.com/security/advisory/?id=NC-SA-2018-008
• https://lists.opensuse.org/opensuse-updates/2018-08/msg00154.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3780

SRPMS

6/core

• nextcloud-13.0.6-1.mga6