Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

CVE-2022-39332 | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceCVE-2022-39332

CVE-2022-39332

MEDIUM4.6

Cross-site scripting (XSS) in Nextcloud Desktop Client

Published Nov 25, 2022

Modified 5 months ago

Details

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via user status and information. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.

References

https://github.com/nextcloud/desktop/pull/4972

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-q9f6-4r6r-h74p

https://hackerone.com/reports/1707977

https://lists.debian.org/debian-lts-announce/2025/09/msg00018.html

https://www.cve.org/CVERecord?id=CVE-2022-39332

CVSS Analysis

CVSS v3.1

4.6

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

NoneA:N

4.6/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness Type (CWE)

Injection

Cross-site Scripting (XSS)

Ecosystems

Timeline

PublishedNov 25, 2022

ModifiedNov 3, 2025