CVE-2017-0890

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Nextcloud	Nextcloud Server	before 11.0.3

References

https://hackerone.com/reports/213227Third Party Advisory
https://nextcloud.com/security/advisory/?id=nc-sa-2017-007Broken Link, Patch, Vendor Advisory
https://hackerone.com/reports/213227Third Party Advisory
https://nextcloud.com/security/advisory/?id=nc-sa-2017-007Broken Link, Patch, Vendor Advisory

Timeline

Published: May 8, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-08915.4Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabiliti CVE-2017-08923.5Nextcloud Server before 11.0.3 is vulnerable to an improper session handling allowed an application specific password without permission to CVE-2017-08935.4Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which CVE-2017-08944.3Nextcloud Server before 11.0.3 is vulnerable to disclosure of valid share tokens for public calendars due to a logical error. Thus granting CVE-2017-08953.5Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that CVE-2017-08966.5Zulip Server 1.5.1 and below suffer from an error in the implementation of the invite_by_admins_only setting in the Zulip group chat applica CVE-2017-08977.5ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the to CVE-2017-08989.1Ruby before 2.4.2, 2.3.5, and 2.2.8 is vulnerable to a malicious format string which contains a precious specifier (*) with a huge minus val CVE-2017-08999.8RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printin CVE-2017-09007.5RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against Ruby CVE-2017-09017.5RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any f CVE-2017-09028.1RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client