CyberRota Analysis
AI-GeneratedDrawIO for ownCloud versions prior to 1.0.2 are vulnerable to stored cross-site scripting (XSS) due to improper input handling during web page generation, allowing attackers with access to the application to execute malicious scripts. This vulnerability poses a high risk as it can lead to unauthorized data access and manipulation. Organizations using DrawIO with ownCloud should prioritize upgrading to version 1.0.2 or later, or ownCloud 10 to version 10.15.3 or later, to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud prior to version 1.0.2, which corresponds to ownCloud 10 prior to version 10.15.3, attackers with access to the DrawIO app can leverage improper neutralization of input during web page generation to achieve stored XSS. Upgrade ownCloud 10 to version 10.15.3 or later or upgrade DrawIO for ownCloud 10 to version 1.0.2 or later to receive a patch.