PT-2018-16182 · Nextcloud · Nextcloud Calendar

Published 2018-07-05 · Updated 2023-02-28 · CVE-2018-3763

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Calendar versions prior to 1.5.8 Nextcloud Calendar versions prior to 1.6.1

Description A stored XSS issue exists due to missing sanitization of search results for an autocomplete field, requiring user-interaction. This issue is limited to group names and can only be exploited by privileged users, such as admins or group admins.

Recommendations For Nextcloud Calendar versions prior to 1.5.8, update to version 1.5.8 or later. For Nextcloud Calendar versions prior to 1.6.1, update to version 1.6.1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-3763

Affected Products

Nextcloud Calendar

References · 3

• https://osv.dev/vulnerability/CVE-2018-3763 · Vendor Advisory
• https://nextcloud.com/security/advisory/?id=nc-sa-2018-004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-3763 · Security Note