Cross-Site Request Forgery (CSRF)

2023-05-1502:20:05

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

cross-site request forgery

nextcloud-client

windows

vulnerability

0.001 Low

EPSS

Percentile

41.1%

JSON

nextcloud-client is vulnerable to Cross-Site Request Forgery (CSRF). A malicious attacker could make a user send a POST request with an arbitrary body if they click a malicious deep link on a windows based machine exploiting it to the vulnerability.

CPENameOperatorVersion
nextcloud-client:edgeeq3.1.3-r0
nextcloud-client:edgeeq2.6.3-r2
nextcloud-client:edgeeq3.6.0-r0
nextcloud-client:edgeeq3.4.4-r1
nextcloud-client:edgeeq2.6.4-r0
nextcloud-client:edgeeq3.4.4-r2
nextcloud-client:edgeeq3.1.3-r1
nextcloud-client:edgeeq3.3.5-r0
nextcloud-client:edgeeq3.5.4-r0
nextcloud-client:edgeeq3.4.4-r0

Name	Operator	Version
nextcloud-client:edge	eq	3.1.3-r0
nextcloud-client:edge	eq	2.6.3-r2
nextcloud-client:edge	eq	3.6.0-r0
nextcloud-client:edge	eq	3.4.4-r1
nextcloud-client:edge	eq	2.6.4-r0
nextcloud-client:edge	eq	3.4.4-r2
nextcloud-client:edge	eq	3.1.3-r1
nextcloud-client:edge	eq	3.3.5-r0
nextcloud-client:edge	eq	3.5.4-r0
nextcloud-client:edge	eq	3.4.4-r0