CVE-2017-0893 - AskarLabs CVE Database

CVE-2017-0893

Vendor Nextcloud

Product Nextcloud Server

Weakness CWE-79 · XSS

Published May 8, 2017

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2. Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers.

Key dates

02Disclosure timeline

May 8, 2017 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2017-0893 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2025-34406 MailEnable < 10.54 Reflected XSS in Id Parameter of Mobile/ContactDetails.aspx CVE-2021-32798 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebook CVE-2024-9174 Stored HTML Injection in Hubshare social module CVE-2025-12045 Orbit Fox Companion <= 3.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Taxonomy CVE-2024-43728 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)