CVE-2022-39331 MEDIUM

CVE-2022-39331: Cross-site Scripting (XSS) in Nexcloud Desktop Client

Vendor Nextcloud

Product security-advisories

Weakness CWE-79 · XSS

Published November 25, 2022

Last update November 3, 2025

View on NVD All CVEs

CVSS base score

4.6/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in the notifications. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

November 25, 2022 CVE published

November 3, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-39331 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-47185 WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Scripting (XSS) CVE-2022-3539 Testimonials (Free < 2.7, Pro < 1.0.8) - Admin+ Stored Cross-Site Scripting CVE-2026-0580 SourceCodester API Key Manager App Import Key cross site scripting CVE-2021-24261 HT Mega - Absolute Addons for Elementor Page Builder < 1.5.7 - Contributor+ Stored XSS CVE-2023-33213 WordPress wpView Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)