CVE-2021-39222

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Talk application was vulnerable to a stored Cross-Site Scripting (XSS) vulnerability. For exploitation, a user would need to right-click on a malicious file and open the file in a new tab. Due the strict Content-Security-Policy shipped with Nextcloud, this issue is not exploitable on modern browsers supporting Content-Security-Policy. It is recommended that the Nextcloud Talk application is upgraded to patched versions 10.0.7, 10.1.4, 11.1.2, 11.2.0 or 12.0.0. As a workaround, use a browser that has support for Content-Security-Policy.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-434

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	< 10.0.7; >= 10.1.0, < 10.1.4; >= 11.1.0, < 11.1.2; < 11.2.0; >= 12.0.0.alpha-1, < 12.0.0

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xhxq-f4vg-jw5gThird Party Advisory
https://github.com/nextcloud/spreed/pull/542Third Party Advisory
https://hackerone.com/reports/1135481Permissions Required, Third Party Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-xhxq-f4vg-jw5gThird Party Advisory
https://github.com/nextcloud/spreed/pull/542Third Party Advisory
https://hackerone.com/reports/1135481Permissions Required, Third Party Advisory

Timeline

Published: Nov 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-392235.3Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud Richdocuments application prior to versions 3.8.6 and 4.2.3 re CVE-2021-392245.3Nextcloud is an open-source, self-hosted productivity platform. The Nextcloud OfficeOnline application prior to version 1.1.1 returned verba CVE-2021-392258.1Nextcloud is an open-source, self-hosted productivity platform. A missing permission check in Nextcloud Deck before 1.2.9, 1.4.5 and 1.5.3 a CVE-2021-392267.3Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the sna CVE-2021-392279.8ZRender is a lightweight graphic library providing 2d draw for Apache ECharts. In versions prior to 5.2.1, using `merge` and `clone` helper CVE-2021-392289.8Tremor is an event processing system for unstructured data. A vulnerability exists between versions 0.7.2 and 0.11.6. This vulnerability is CVE-2021-392297.5Apprise is an open source library which allows you to send a notification to almost all of the most popular notification services available.CVE-2021-39232.3A flaw was found in the Linux kernel's implementation of RDMA over infiniband. An attacker with a privileged local account can leak kernel s CVE-2021-392306.5Butter is a system usability utility. Due to a kernel error the JPNS kernel is being discontinued. Affected users are recommend to update to CVE-2021-392319.1In Apache Ozone versions prior to 1.2.0, Various internal server-to-server RPC endpoints are available for connections, making it possible f CVE-2021-392328.8In Apache Ozone versions prior to 1.2.0, certain admin related SCM commands can be executed by any authenticated users, not just by admins.CVE-2021-392339.1In Apache Ozone versions prior to 1.2.0, Container related Datanode requests of Ozone Datanode were not properly authorized and can be calle