Name As user2 autocomplete the name in the comments input (or Talk chat input) Click on the user name you just autocompleted User2 is redirected to https://nextcloud.com Only works...">Nextcloud: HTML injection with AutoComplete suggestions - vulnerability database | Vulners.comName As user2 autocomplete the name in the comments input (or Talk chat input) Click on the user name you just autocompleted User2 is redirected to https://nextcloud.com Only works...">Name As user2 autocomplete the name in the comments input (or Talk chat input) Click on the user name you just autocompleted User2 is redirected to https://nextcloud.com Only works...">Name As user2 autocomplete the name in the comments input (or Talk chat input) Click on the user name you just autocompleted User2 is redirected to https://nextcloud.com Only works...">

Lucene search

K

NickvergessenH1:383117

HistoryJul 18, 2018 - 1:45 p.m.

Nextcloud: HTML injection with AutoComplete suggestions

2018-07-1813:45:00

nickvergessen

hackerone.com

24

EPSS

0.001

Percentile

22.7%

As user1 set your displayname to <a href="https://nextcloud.com">Name</a>
As user2 autocomplete the name in the comments input (or Talk chat input)
Click on the user name you just autocompleted

User2 is redirected to https://nextcloud.com

Only works with HTML, not with script

Impact

User1 can trick user2 to render any html

EPSS

0.001

Percentile

22.7%

Related for H1:383117

suse5 nvd2 osv2 cvelist2 openvas4 nessus4 nextcloud2 prion2 cve2 mageia1 rosalinux1