PT-2023-6404 · Nextcloud+1 · Nextcloud Calendar+1

Whoisshuvam · Publicado 2023-07-09 · Atualizado 2023-10-20 · CVE-2023-45150

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Calendar app versions prior to 4.4.4

Description The issue is related to missing precondition checks in the Nextcloud calendar app, which causes the server to attempt validation of strings of any length as email addresses. This can lead to the server becoming busy and unresponsive, potentially allowing a remote attacker to cause a denial of service.

Recommendations For versions prior to 4.4.4, upgrade the Nextcloud Calendar app to 4.4.4. As a temporary workaround for users unable to upgrade, disable the calendar app.

Exploit

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-354

CWE-400

Identificadores relacionados

BDU:2023-07118

CVE-2023-45150

GHSA-R936-8GWM-W452

Produtos afetados

Nextcloud Calendar

Red Os

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45150.json · Exploit
• 🔥 https://hackerone.com/reports/2058337 · Exploit
• https://github.com/nextcloud/calendar/pull/5358 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-45150 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-45150 · Nota de Segurança
• https://vuldb.com/ru/?id.242309 · Nota
• https://bdu.fstec.ru/vul/2023-07118 · Nota de Segurança
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nextcloud-calendar-cve-2023-45150 · Nota
• https://t.me/cibsecurity/72371 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1714051220824895791 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1713996721892528251 · Publicação no Twitter