DrawIO for ownCloud versions before 1.0.2, corresponding to ownCloud 10 versions before 10.15.3, contain a stored cross-site scripting vulnerability (CWE-79) due to improper input neutralization during web page generation. This allows attackers with access to the DrawIO app to inject malicious scripts that are stored and later executed in users' browsers. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with network attack vector, low attack complexity, required privileges, user interaction, and impacts on confidentiality, integrity, and availability. The issue is fixed by upgrading to DrawIO for ownCloud 1.0.2 or ownCloud 10.15.3 or later.

Successful exploitation of this vulnerability can lead to stored cross-site scripting attacks, allowing an attacker with access to the DrawIO app to execute arbitrary scripts in the context of the victim's browser. This can result in high confidentiality impact, limited integrity impact, and limited availability impact as per the CVSS vector. The attacker could potentially steal sensitive information, perform actions on behalf of the user, or disrupt availability of the affected application.

A fix is available by upgrading DrawIO for ownCloud to version 1.0.2 or later, or ownCloud 10 to version 10.15.3 or later. Users should apply these updates to remediate the vulnerability. No other mitigation guidance is provided or necessary as the issue is addressed by these official fixes.