CVE-2024-22213

    Dashboard / Vulnerabilities / CVE-2024-22213

    CVE-2024-22213

    Published: 18 Jan 2024Last Modified: 12 Aug 2026

    Summary: Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app

    Details: Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affected versions users could be tricked into executing malicious code that would execute in their browser via HTML sent as a comment. It is recommended that the Nextcloud Deck is upgraded to version 1.9.5 or 1.11.2. There are no known workarounds for this vulnerability.

    References: https://hackerone.com/reports/2058556, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22213.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-mg7w-x9fm-9wwc, https://nvd.nist.gov/vuln/detail/CVE-2024-22213, https://github.com/nextcloud/deck/commit/91f1557362047f8840f53151f176b80148650bcd

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- d9014903ac9cc54303c8a340c15faca1672f9967
    Fixed -3aa3d57c3b388a9b9b4856e6c39b55a70b54dc15

    Affected versions

    v1.9.4
    v1.9.3
    v1.9.2
    v1.9.1
    v1.9.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-22213 | CVE-DB