PT-2022-16913 · Nextcloud+1 · Nextcloud Calendar+1

Miaulalala + 1 · Published 2022-04-11 · Updated 2025-03-26 · CVE-2022-24838

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Nextcloud Calendar versions prior to 3.2.2

Description The issue concerns SMTP Command Injection in appointment emails. It occurs because newlines and special characters in the email value within the JSON request are not sanitized. This allows a malicious attacker to inject newlines, breaking out of the RCPT TO:<BOOKING USER'S EMAIL> SMTP command and enabling the injection of arbitrary SMTP commands.

Recommendations For versions prior to 3.2.2, upgrade to version 3.2.2 to resolve the issue. At the moment, there are no workarounds available for this issue.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-93

Related Identifiers

BDU:2025-03807

CVE-2022-24838

GHSA-8XV5-4855-24QF

Affected Products

Nextcloud Calendar

Red Os

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24838.json · Exploit
• https://github.com/nextcloud/calendar/pull/4073 · Patch
• https://github.com/nextcloud/calendar/commit/7b70edfb8a0fcf0926f613ababcbd56c6ecd9f35 · Patch
• https://osv.dev/vulnerability/CVE-2022-24838 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24838 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-03807 · Security Note
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qf · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/uyazvimost-nextcloud-cve-2022-24838 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nextcloud-cve-2022-24838 · Note