CVE-2021-39221

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Contacts application prior to version 4.0.3 was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Contacts application is upgraded to 4.0.3. As a workaround, one may use a browser that has support for Content-Security-Policy.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-434

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 4.0.3

References

https://github.com/nextcloud/contacts/pull/2407Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j6cx-mxqf-f9vcThird Party Advisory
https://github.com/nextcloud/contacts/pull/2407Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-j6cx-mxqf-f9vcThird Party Advisory

Timeline

Published: Oct 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-392226.1Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripti CVE-2021-392235.3Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 re CVE-2021-392245.3Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verba CVE-2021-392258.1Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 a CVE-2021-392267.3Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the sna CVE-2021-392279.8ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper CVE-2021-392289.8Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is CVE-2021-392297.5Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available.CVE-2021-39232.3A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel s CVE-2021-392306.5Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update to CVE-2021-392319.1In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible f CVE-2021-392328.8In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.