CVE-2016-9465

    Dashboard / Vulnerabilities / CVE-2016-9465

    CVE-2016-9465

    Published: 28 Mar 2017Last Modified: 7 Aug 2026

    Summary:

    Details: Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Stored XSS in CardDAV image export. The CardDAV image export functionality as implemented in Nextcloud/ownCloud allows the download of images stored within a vCard. Due to not performing any kind of verification on the image content this is prone to a stored Cross-Site Scripting attack.

    References: https://github.com/nextcloud/server/commit/68ab8325c799d20c1fb7e98d670785176590e7d0, https://github.com/owncloud/core/commit/6bf3be3877d9d9fda9c66926fe273fe79cbaf58e, https://github.com/owncloud/core/commit/b5a5be24c418033cb2ef965a4f3f06b7b4213845, https://nextcloud.com/security/advisory/?id=nc-sa-2016-008, https://owncloud.org/security/advisory/?id=oc-sa-2016-018, https://hackerone.com/reports/163338

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 43ce8b13c1422ed82f42886b5918159f05b36967
    Fixed -12ec1d1e3e5d90140e2afaca8afc3727dadeca1a

    Affected versions

    v10.0.1RC1
    v10.0.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High