PT-2023-30770 · Nextcloud · Nextcloud Calendar

Nvz0X + 1 · Publicado 2023-12-21 · Atualizado 2024-01-09 · CVE-2023-48308

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Calendar app versions prior to 4.5.3

Description An issue exists where an attacker can gain access to the stacktrace and internal paths of the server when generating an exception while editing a calendar appointment.

Recommendations For versions prior to 4.5.3, upgrade the Nextcloud Calendar app to version 4.5.3 to resolve the issue. As a temporary workaround, consider restricting access to the calendar editing feature until the upgrade is applied.

Exploit

Correção

Enumeração de Fraquezas

CWE-212

CWE-1258

Identificadores relacionados

CVE-2023-48308

GHSA-FV3C-QVJR-5RV8

Produtos afetados

Nextcloud Calendar

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48308.json · Exploit
• https://github.com/nextcloud/calendar/pull/5553 · Aviso do Fabricante
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8 · Aviso do Fabricante
• https://t.me/cvenotify/64796 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-48308 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-48308 · Nota de Segurança
• https://t.me/cvenotify/66762 · Publicação no Telegram