Skip to main content

Mondoo

Vulnerability Management
Technology
Services

Solutions

Financial Services
Manufacturing
Healthcare

Resources

Blog
Vulnerability Database
Documentation
GitHub

Company

About
Careers
Partners
Contact

Legal

Privacy
Terms
Imprint

© 2026 Mondoo, Inc.

Log in Get Assessment

Vulnerability IntelligenceCVE-2022-39333

CVE-2022-39333

MEDIUM4.6

Cross-site scripting (XSS) in Nextcloud Desktop Client

Published Nov 25, 2022

Modified 5 months ago

Details

Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It is recommended that the Nextcloud Desktop client is upgraded to 3.6.1. There are no known workarounds for this issue.

References

https://github.com/nextcloud/desktop/pull/4972

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-92p9-x79h-2mj8

https://hackerone.com/reports/1711847

https://lists.debian.org/debian-lts-announce/2025/09/msg00018.html

https://www.cve.org/CVERecord?id=CVE-2022-39333

CVSS Analysis

CVSS v3.1

4.6

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

RequiredUI:R

Scope

Scope

UnchangedS:U

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

NoneA:N

4.6/CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness Type (CWE)

Injection

Cross-site Scripting (XSS)

Ecosystems

Timeline

PublishedNov 25, 2022

ModifiedNov 3, 2025

CVE-2022-39333 | Mondoo Vulnerability Intelligence