CVE-2020-8189
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html ...
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.
- Record
CVE-2020-8189- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.
- Record
CVE-2020-8189- Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2020-29067 No score
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.
- Record
EUVD-2020-29067- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vc58-g8xx-fx3p
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html ...
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.
- Record
GHSA-vc58-g8xx-fx3p- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.
- Record
CVE-2020-8189- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-8189
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.
- Record
DEBIAN-CVE-2020-8189- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-8189
A cross-site scripting error in Nextcloud Desktop client 2.6.4 allowed to present any html (including local links) when responding with invalid data on the login attempt.
- Record
UBUNTU-CVE-2020-8189- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nextcloud-desktopDebian:12 |
before 3.0.1-1 | 3.0.1-1 |
nextcloud-desktopDebian:13 |
before 3.0.1-1 | 3.0.1-1 |
nextcloud-desktopDebian:14 |
before 3.0.1-1 | 3.0.1-1 |
nextcloud-desktopUbuntu:20.04:LTS |
All versions, plus listed versions 2.5.3-12.6.0-12.6.1-12.6.1-22.6.2-12.6.2-1build1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-8189 is a medium vulnerability (CVSS 5.4) in Nextcloud Desktop, published August 21, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.40%, the 72nd percentile. Fixed in nextcloud-desktop 3.0.1-1.
References
hackerone.com/reports/685552
nextcloud.com/security/advisory?id=NC-SA-2020-027
security.gentoo.org/glsa/202009-09
nvd.nist.gov/vuln/detail/CVE-2020-8189
github.com/advisories/GHSA-vc58-g8xx-fx3p
security-tracker.debian.org/tracker/CVE-2020-8189
ubuntu.com/security/CVE-2020-8189
cve.org/CVERecord?id=CVE-2020-8189