CVE-2019-15619

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-15619
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15619.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-15619
Published
2020-02-04T20:15:12.340Z
Modified
2026-07-08T16:08:28.568394Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

Improper neutralization of file names, conversation names and board names in Nextcloud Server 16.0.3, Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.

References

Affected packages

Git
github.com/nextcloud/deck

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/deck
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7d52891eb80fab12aa698a8a4d6e0121e9ff0625
Database specific 
{
    "cpe": "cpe:2.3:a:nextcloud:deck:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.6.6"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.1.3
v0.1.4
v0.2.0
v0.2.1
v0.2.2
v0.3.0
v0.3.0-beta1
v0.3.1
v0.4.0
v0.4.0-beta1
v0.4.0-beta2
v0.4.0-beta3
v0.4.0-beta4
v0.4.0-beta5
v0.4.1
v0.5.0
v0.5.0-beta1
v0.5.0-rc1
v0.5.0-rc2
v0.5.1
v0.5.2
v0.6.0
v0.6.0-beta1
v0.6.0-beta2
v0.6.1
v0.6.2
v0.6.3
v0.6.4
v0.6.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15619.json"
github.com/nextcloud/server

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/server
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a1a245e88202d834f08f4c2e4451dcbe9baee3aa
Database specific 
{
    "cpe": "cpe:2.3:a:nextcloud:nextcloud_server:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "16.0.4"
        }
    ]
}

Affected versions

16.*
16.0.0RC2
v1.*
v1.0.0beta1
v11.*
v11.0.0
v11.0RC2
v12.*
v12.0.0beta1
v12.0.0beta2
v12.0.0beta3
v12.0.0beta4
v13.*
v13.0.0RC1
v13.0.0beta1
v13.0.0beta2
v13.0.0beta3
v13.0.0beta4
v14.*
v14.0.0RC1
v14.0.0RC2
v14.0.0beta1
v14.0.0beta2
v14.0.0beta3
v14.0.0beta4
v15.*
v15.0.0RC1
v15.0.0beta1
v15.0.0beta2
v16.*
v16.0.0
v16.0.0RC1
v16.0.0alpha1
v16.0.0beta1
v16.0.0beta2
v16.0.0beta3
v16.0.1
v16.0.1RC1
v16.0.2
v16.0.2RC1
v16.0.3
v16.0.4RC1
v3.*
v3.0
v4.*
v4.0.0
v4.0.0RC
v4.0.0RC2
v4.0.0beta
v4.0.1
v4.0.4
v4.0.5
v4.0.6
v4.5.0
v4.5.0RC1
v4.5.0RC2
v4.5.0RC3
v4.5.0beta3
v4.5.0beta4
v5.*
v5.0.0
v5.0.0RC1
v5.0.0RC2
v5.0.0RC3
v5.0.0alpha1
v5.0.0beta1
v5.0.0beta2
v6.*
v6.0.0RC1
v6.0.0RC2
v6.0.0alpha2
v6.0.0beta2
v6.0.0beta3
v6.0.0beta4
v6.0.0beta5
v7.*
v7.0.0alpha2
v7.0.0beta1
v8.*
v8.0.0
v8.0.0RC1
v8.0.0RC2
v8.0.0alpha1
v8.0.0alpha2
v8.0.0beta1
v8.0.0beta2
v8.1.0alpha1
v8.1.0alpha2
v8.1.0beta1
v8.1.0beta2
v8.1RC2
v8.2RC1
v8.2beta1
v9.*
v9.0.0beta2
v9.0beta1
v9.1.0beta1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15619.json"
github.com/nextcloud/spreed

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/spreed
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d71d57dbf385d8e51aa75d87fe1703cc615c013b
Database specific 
{
    "cpe": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.0.4"
        }
    ]
}

Affected versions

v1.*
v1.0.21
v1.0.22
v1.1.2
v1.2
v2.*
v2.0.0
v2.9.0
v2.9.1
v3.*
v3.0.0
v3.0.1
v3.99.10
v3.99.11
v3.99.12
v3.99.8
v4.*
v4.0.0
v4.99.5
v5.*
v5.99.10
v6.*
v6.0.0
v6.0.0-rc.1
v6.0.0-rc.2
v6.0.1
v6.0.2
v6.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15619.json"
github.com/nextcloud/talk-android

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/talk-android
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
96de8ceb935e5005e95b1d7409075ef74c2fb528
Database specific 
{
    "cpe": "cpe:2.3:a:nextcloud:talk:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.0.4"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.1.2
v0.2.0
v1.*
v1.0
v1.0.1
v1.0.10
v1.0.11
v1.0.12
v1.0.13
v1.0.14
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.0.9
v1.1.0
v1.1.0beta1
v1.1.0beta2
v1.1.0beta3
v1.1.0beta4
v1.1.1
v1.2.0beta1
v1.2.0beta2
v1.2.0beta3
v2.*
v2.0.0
v2.0.0beta4
v2.0.0beta5
v2.1.0
v2.1.0beta1
v2.1.0beta2
v2.1.0beta3
v2.1.0beta4
v2.1.0beta5
v3.*
v3.0.0
v3.0.0beta1
v3.0.0beta10
v3.0.0beta3
v3.0.0beta4
v3.0.0beta5
v3.0.0beta6
v3.0.0beta7
v3.0.0beta8
v3.0.1
v3.1.0
v3.1.0beta1
v3.1.0beta2
v3.1.0beta3
v3.1.0beta4
v3.1.0beta5
v3.1.0beta6
v3.2.0beta1
v3.2.0beta2
v3.2.0beta3
v3.2.0beta4
v3.2.0beta5
v3.3.0beta1
v3.3.0beta2
v3.3.0beta3
v6.*
v6.0.0
v6.0.0beta1
v6.0.0beta2
v6.0.0beta3
v6.0.0beta4
v6.0.3

Database specific

vanir_signatures 
[
    {
        "digest": {
            "length": 632.0,
            "function_hash": "298371678596391023087716559718708850582"
        },
        "signature_version": "v1",
        "source": "https://github.com/nextcloud/talk-android/commit/96de8ceb935e5005e95b1d7409075ef74c2fb528",
        "signature_type": "Function",
        "target": {
            "function": "joinRoomWithRoomTokenAndSession",
            "file": "app/src/main/java/com/nextcloud/talk/webrtc/MagicWebSocketInstance.java"
        },
        "id": "CVE-2019-15619-1597a010",
        "deprecated": false
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "197700212335015500041838697513846064728",
                "86308677864318993497408718807494758661",
                "110614973695056361178640246290610247119",
                "257560811681439136534511970816853692402",
                "240712112128381599083847548699798567078",
                "101553157878789736064076680940630740942",
                "299291355225054030123352048214213677835",
                "119599119503376397888828285134289858133",
                "155934923995627190679106257561340007070",
                "247395927670163166242791463578940004561",
                "312277393331497870185067007153234610936",
                "252722396108618984351491563116782303778",
                "62810169808014941250870117488332285042",
                "133154326832986357381609166514415773375",
                "197634367623488963880911111823819155085",
                "261176701202609996978472474122063575686",
                "323108818648551323917903866579290223656",
                "40745026477516682411085469881153256086",
                "25940077064843905954910657866120618110",
                "190370760082845276864705417331985393746",
                "117393689574739830005806184478255298581",
                "165630151192618464192705554388138183120",
                "152573999556475080784009614742589607865",
                "121254117625421490349136479045968546655",
                "98666307130977921840354563868882787241",
                "12626809874493150368863702282156572469",
                "102143505945976651087241459943848278243"
            ]
        },
        "signature_version": "v1",
        "source": "https://github.com/nextcloud/talk-android/commit/96de8ceb935e5005e95b1d7409075ef74c2fb528",
        "signature_type": "Line",
        "target": {
            "file": "app/src/main/java/com/nextcloud/talk/webrtc/MagicWebSocketInstance.java"
        },
        "id": "CVE-2019-15619-b02cd2a7",
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-07-08T16:08:28Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-15619.json"