Description
Versions of nextcloud-vue-collections prior to 0.4.2 are vulnerable to Cross-Site Scripting (XSS). The v-tooltip component has an insecure defaultHTML configuration that allows arbitrary JavaScript to be injected in the tooltip of a collection item. This allows attackers to execute arbitrary code in a victim’s browser.
Recommendation
Update the nextcloud-vue-collections package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.4.2
- Patched version(s): 0.4.2
References
Could your website be exposed too?
SmartScanner can check your website for Cross-Site Scripting in nextcloud-vue-collections and gives you actionable findings to investigate.
Start a free scanRelated Issues
- vue-i18n has cross-site scripting vulnerability with prototype pollution - CVE-2024-52809
- vue-i18n has cross-site scripting vulnerability with prototype pollution - vue-i18n - CVE-2024-52809
- vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/vue-i18n-core - CVE-2024-52809
- vue-i18n has cross-site scripting vulnerability with prototype pollution - @intlify/core - CVE-2024-52809
You might also like:
See something that needs correcting? Let us knowUpdated January 09, 2023