CVE-2024-22213: nextcloud deck Cross-site Scripting
Vulnerability summary
CVE-2024-22213 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in nextcloud deck. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 41.9% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 18-01-2024PublishedVulnerability first disclosed.
- 13-11-2024Last modifiedVulnerability information updated.
Description
Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users could be tricked into executing malicious code that would execute in their browser via HTML sent as a comment. It is recommended that the Nextcloud Deck is upgraded to version 1.9.5 or 1.11.2. There are no known workarounds for this vulnerability.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA0.0UnknownCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:NDiffers
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
0.00 pp
From 0.51% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundSecurity Advisories
Maturity: poc
Exploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Nextcloud2 products
- deck≥ 1.9.0, < 1.9.5 | ≥ 1.10.0, < 1.11.2
- security-advisories≥ 1.9.0, < 1.9.5 | ≥ 1.10.0, < 1.11.2
1 vendor · 2 products
References
3 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-mg7w-x9fm-9wwcX Refsource CONFIRMExploitPatchVendor Advisory