3.5Düşük
CVE-2025-66514Nextcloud Mail stored HTML injection in subject text
Açıklama
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Prior to 5.5.3, a stored HTML injection in the Mail app's message list allowed an authenticated user to inject HTML into the email subjects. Javascript was correctly blocked by the content security policy of the Nextcloud Server code.
Zayıflık türü (CWE):
CWE-79
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| nextcloud | < 5.5.3 | ||
| nextcloud | security-advisories | >= 5.2.0-beta.1, < 5.5.3 |
Kaynaklar ve yamalar
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-v394-8gpc-6fv5 PatchVendor Advisory
- https://github.com/nextcloud/mail/pull/11740 Issue TrackingPatch
- https://github.com/nextcloud/mail/commit/c64fcc3b79e0c089b5e1d2e04a07bfa740b2ac09 Patch
- https://hackerone.com/reports/3357036 Vendor Advisory
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:nextcloud:mail:*:*:*:*:*:nextcloud:*:*< 5.5.3