CVE-2023-23942 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2023-23942 Interim 1 7 2025-02-16T02:21:08Z current 2023-02-08T00:23:30Z 2025-02-16T02:21:08Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2023-23942 The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IHDC7NYZMDNIUM6KMGVNGTIO5AKPD4O7/ E-Mail link for openSUSE-SU-2023:0090-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MYOV4BMU2LQGVZ5NTYTI7BA3XMRNOCDF/ E-Mail link for openSUSE-SU-2023:0171-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Package Hub 15 SP4 SUSE Package Hub 15 SP5 openSUSE Leap 15.4 openSUSE Leap 15.5 caja-extension-nextcloud-3.8.0-bp154.2.3.1 caja-extension-nextcloud-3.8.0-bp155.2.3.1 cloudproviders-extension-nextcloud-3.8.0-bp154.2.3.1 cloudproviders-extension-nextcloud-3.8.0-bp155.2.3.1 libnextcloudsync-devel-3.8.0-bp154.2.3.1 libnextcloudsync-devel-3.8.0-bp155.2.3.1 libnextcloudsync0-3.8.0-bp154.2.3.1 libnextcloudsync0-3.8.0-bp155.2.3.1 nautilus-extension-nextcloud-3.8.0-bp154.2.3.1 nautilus-extension-nextcloud-3.8.0-bp155.2.3.1 nemo-extension-nextcloud-3.8.0-bp154.2.3.1 nemo-extension-nextcloud-3.8.0-bp155.2.3.1 nextcloud-desktop-3.8.0-bp154.2.3.1 nextcloud-desktop-3.8.0-bp155.2.3.1 nextcloud-desktop-doc-3.8.0-bp154.2.3.1 nextcloud-desktop-doc-3.8.0-bp155.2.3.1 nextcloud-desktop-dolphin-3.8.0-bp154.2.3.1 nextcloud-desktop-dolphin-3.8.0-bp155.2.3.1 nextcloud-desktop-lang-3.8.0-bp154.2.3.1 nextcloud-desktop-lang-3.8.0-bp155.2.3.1 caja-extension-nextcloud-3.8.0-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 cloudproviders-extension-nextcloud-3.8.0-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 libnextcloudsync-devel-3.8.0-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 libnextcloudsync0-3.8.0-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 nautilus-extension-nextcloud-3.8.0-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 nemo-extension-nextcloud-3.8.0-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 nextcloud-desktop-3.8.0-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 nextcloud-desktop-doc-3.8.0-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 nextcloud-desktop-dolphin-3.8.0-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 nextcloud-desktop-lang-3.8.0-bp154.2.3.1 as a component of SUSE Package Hub 15 SP4 caja-extension-nextcloud-3.8.0-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 cloudproviders-extension-nextcloud-3.8.0-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 libnextcloudsync-devel-3.8.0-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 libnextcloudsync0-3.8.0-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 nautilus-extension-nextcloud-3.8.0-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 nemo-extension-nextcloud-3.8.0-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 nextcloud-desktop-3.8.0-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 nextcloud-desktop-doc-3.8.0-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 nextcloud-desktop-dolphin-3.8.0-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 nextcloud-desktop-lang-3.8.0-bp155.2.3.1 as a component of SUSE Package Hub 15 SP5 caja-extension-nextcloud-3.8.0-bp154.2.3.1 as a component of openSUSE Leap 15.4 cloudproviders-extension-nextcloud-3.8.0-bp154.2.3.1 as a component of openSUSE Leap 15.4 libnextcloudsync-devel-3.8.0-bp154.2.3.1 as a component of openSUSE Leap 15.4 libnextcloudsync0-3.8.0-bp154.2.3.1 as a component of openSUSE Leap 15.4 nautilus-extension-nextcloud-3.8.0-bp154.2.3.1 as a component of openSUSE Leap 15.4 nemo-extension-nextcloud-3.8.0-bp154.2.3.1 as a component of openSUSE Leap 15.4 nextcloud-desktop-3.8.0-bp154.2.3.1 as a component of openSUSE Leap 15.4 nextcloud-desktop-doc-3.8.0-bp154.2.3.1 as a component of openSUSE Leap 15.4 nextcloud-desktop-dolphin-3.8.0-bp154.2.3.1 as a component of openSUSE Leap 15.4 nextcloud-desktop-lang-3.8.0-bp154.2.3.1 as a component of openSUSE Leap 15.4 caja-extension-nextcloud-3.8.0-bp155.2.3.1 as a component of openSUSE Leap 15.5 cloudproviders-extension-nextcloud-3.8.0-bp155.2.3.1 as a component of openSUSE Leap 15.5 libnextcloudsync-devel-3.8.0-bp155.2.3.1 as a component of openSUSE Leap 15.5 libnextcloudsync0-3.8.0-bp155.2.3.1 as a component of openSUSE Leap 15.5 nautilus-extension-nextcloud-3.8.0-bp155.2.3.1 as a component of openSUSE Leap 15.5 nemo-extension-nextcloud-3.8.0-bp155.2.3.1 as a component of openSUSE Leap 15.5 nextcloud-desktop-3.8.0-bp155.2.3.1 as a component of openSUSE Leap 15.5 nextcloud-desktop-doc-3.8.0-bp155.2.3.1 as a component of openSUSE Leap 15.5 nextcloud-desktop-dolphin-3.8.0-bp155.2.3.1 as a component of openSUSE Leap 15.5 nextcloud-desktop-lang-3.8.0-bp155.2.3.1 as a component of openSUSE Leap 15.5 The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as `strong`, `em` and `head` lines in the UI of the desktop client. The lack of sanitisation may allow for javascript injection. It is recommended that the Nextcloud Desktop Client is upgraded to 3.6.3. There are no known workarounds for this issue. CVE-2023-23942 SUSE Package Hub 15 SP4:caja-extension-nextcloud-3.8.0-bp154.2.3.1 SUSE Package Hub 15 SP4:cloudproviders-extension-nextcloud-3.8.0-bp154.2.3.1 SUSE Package Hub 15 SP4:libnextcloudsync-devel-3.8.0-bp154.2.3.1 SUSE Package Hub 15 SP4:libnextcloudsync0-3.8.0-bp154.2.3.1 SUSE Package Hub 15 SP4:nautilus-extension-nextcloud-3.8.0-bp154.2.3.1 SUSE Package Hub 15 SP4:nemo-extension-nextcloud-3.8.0-bp154.2.3.1 SUSE Package Hub 15 SP4:nextcloud-desktop-3.8.0-bp154.2.3.1 SUSE Package Hub 15 SP4:nextcloud-desktop-doc-3.8.0-bp154.2.3.1 SUSE Package Hub 15 SP4:nextcloud-desktop-dolphin-3.8.0-bp154.2.3.1 SUSE Package Hub 15 SP4:nextcloud-desktop-lang-3.8.0-bp154.2.3.1 SUSE Package Hub 15 SP5:caja-extension-nextcloud-3.8.0-bp155.2.3.1 SUSE Package Hub 15 SP5:cloudproviders-extension-nextcloud-3.8.0-bp155.2.3.1 SUSE Package Hub 15 SP5:libnextcloudsync-devel-3.8.0-bp155.2.3.1 SUSE Package Hub 15 SP5:libnextcloudsync0-3.8.0-bp155.2.3.1 SUSE Package Hub 15 SP5:nautilus-extension-nextcloud-3.8.0-bp155.2.3.1 SUSE Package Hub 15 SP5:nemo-extension-nextcloud-3.8.0-bp155.2.3.1 SUSE Package Hub 15 SP5:nextcloud-desktop-3.8.0-bp155.2.3.1 SUSE Package Hub 15 SP5:nextcloud-desktop-doc-3.8.0-bp155.2.3.1 SUSE Package Hub 15 SP5:nextcloud-desktop-dolphin-3.8.0-bp155.2.3.1 SUSE Package Hub 15 SP5:nextcloud-desktop-lang-3.8.0-bp155.2.3.1 openSUSE Leap 15.4:caja-extension-nextcloud-3.8.0-bp154.2.3.1 openSUSE Leap 15.4:cloudproviders-extension-nextcloud-3.8.0-bp154.2.3.1 openSUSE Leap 15.4:libnextcloudsync-devel-3.8.0-bp154.2.3.1 openSUSE Leap 15.4:libnextcloudsync0-3.8.0-bp154.2.3.1 openSUSE Leap 15.4:nautilus-extension-nextcloud-3.8.0-bp154.2.3.1 openSUSE Leap 15.4:nemo-extension-nextcloud-3.8.0-bp154.2.3.1 openSUSE Leap 15.4:nextcloud-desktop-3.8.0-bp154.2.3.1 openSUSE Leap 15.4:nextcloud-desktop-doc-3.8.0-bp154.2.3.1 openSUSE Leap 15.4:nextcloud-desktop-dolphin-3.8.0-bp154.2.3.1 openSUSE Leap 15.4:nextcloud-desktop-lang-3.8.0-bp154.2.3.1 openSUSE Leap 15.5:caja-extension-nextcloud-3.8.0-bp155.2.3.1 openSUSE Leap 15.5:cloudproviders-extension-nextcloud-3.8.0-bp155.2.3.1 openSUSE Leap 15.5:libnextcloudsync-devel-3.8.0-bp155.2.3.1 openSUSE Leap 15.5:libnextcloudsync0-3.8.0-bp155.2.3.1 openSUSE Leap 15.5:nautilus-extension-nextcloud-3.8.0-bp155.2.3.1 openSUSE Leap 15.5:nemo-extension-nextcloud-3.8.0-bp155.2.3.1 openSUSE Leap 15.5:nextcloud-desktop-3.8.0-bp155.2.3.1 openSUSE Leap 15.5:nextcloud-desktop-doc-3.8.0-bp155.2.3.1 openSUSE Leap 15.5:nextcloud-desktop-dolphin-3.8.0-bp155.2.3.1 openSUSE Leap 15.5:nextcloud-desktop-lang-3.8.0-bp155.2.3.1 moderate 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N