CVE-2016-7419 - Vulnerability Details - OpenCVE

Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.002.

Key SSVC decision points have not yet been added.

Vendors	Products
Nextcloud	Nextcloud Server
Owncloud	Owncloud

Configuration 1 [-]

OR	cpe:2.3:a:nextcloud:nextcloud_server::::::::
	cpe:2.3:a:owncloud:owncloud::::::::

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2016-8272	Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://www.securityfocus.com/bid/92373
https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc
https://hackerone.com/reports/145355
https://nextcloud.com/security/advisory/?id=nc-sa-2016-001
https://owncloud.org/security/advisory/?id=oc-sa-2016-011

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2016-09-17T21:00:00

Updated: 2024-08-06T01:57:47.535Z

Reserved: 2016-09-09T00:00:00

Link: CVE-2016-7419

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2016-09-17T21:59:11.777

Modified: 2025-04-12T10:46:40.837

Link: CVE-2016-7419

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-07-19T00:00:00", "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2016-11-25T19:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "92373", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/92373"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://owncloud.org/security/advisory/?id=oc-sa-2016-011"}, {"tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/145355"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://nextcloud.com/security/advisory/?id=nc-sa-2016-001"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2016-7419", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "92373", "refsource": "BID", "url": "http://www.securityfocus.com/bid/92373"}, {"name": "https://owncloud.org/security/advisory/?id=oc-sa-2016-011", "refsource": "CONFIRM", "url": "https://owncloud.org/security/advisory/?id=oc-sa-2016-011"}, {"name": "https://hackerone.com/reports/145355", "refsource": "MISC", "url": "https://hackerone.com/reports/145355"}, {"name": "https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc", "refsource": "CONFIRM", "url": "https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc"}, {"name": "https://nextcloud.com/security/advisory/?id=nc-sa-2016-001", "refsource": "CONFIRM", "url": "https://nextcloud.com/security/advisory/?id=nc-sa-2016-001"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T01:57:47.535Z"}, "title": "CVE Program Container", "references": [{"name": "92373", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/92373"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://owncloud.org/security/advisory/?id=oc-sa-2016-011"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://hackerone.com/reports/145355"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://nextcloud.com/security/advisory/?id=nc-sa-2016-001"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2016-7419", "datePublished": "2016-09-17T21:00:00", "dateReserved": "2016-09-09T00:00:00", "dateUpdated": "2024-08-06T01:57:47.535Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7C653C0-53CE-4CC6-99C5-DB1AC94D539B", "versionEndIncluding": "9.0.51", "vulnerable": true}, {"criteria": "cpe:2.3:a:owncloud:owncloud:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC698542-23B9-4101-BD01-10D2FB0870E9", "versionEndIncluding": "9.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in share.js in the gallery application in ownCloud Server before 9.0.4 and Nextcloud Server before 9.0.52 allows remote authenticated users to inject arbitrary web script or HTML via a crafted directory name."}, {"lang": "es", "value": "Vulnerabilidad de XSS en share.js en la aplicaci\u00f3n de galer\u00eda en ownCloud Server en versiones anteriores a 9.0.4 y Nextcloud Server en versiones anteriores a 9.0.52 permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de un nombre de directorio manipulado."}], "id": "CVE-2016-7419", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.0"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2016-09-17T21:59:11.777", "references": [{"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/92373"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "https://hackerone.com/reports/145355"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://nextcloud.com/security/advisory/?id=nc-sa-2016-001"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://owncloud.org/security/advisory/?id=oc-sa-2016-011"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/92373"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/nextcloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mailing List", "Third Party Advisory"], "url": "https://hackerone.com/reports/145355"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://nextcloud.com/security/advisory/?id=nc-sa-2016-001"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://owncloud.org/security/advisory/?id=oc-sa-2016-011"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}