PT-2023-6404 · Nextcloud+1 · Nextcloud Calendar+1

Whoisshuvam · Published 2023-07-09 · Updated 2023-10-20 · CVE-2023-45150

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Calendar app versions prior to 4.4.4

Description The issue is related to missing precondition checks in the Nextcloud calendar app, which causes the server to attempt validation of strings of any length as email addresses. This can lead to the server becoming busy and unresponsive, potentially allowing a remote attacker to cause a denial of service.

Recommendations For versions prior to 4.4.4, upgrade the Nextcloud Calendar app to 4.4.4. As a temporary workaround for users unable to upgrade, disable the calendar app.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-354

CWE-400

Related Identifiers

BDU:2023-07118

CVE-2023-45150

GHSA-R936-8GWM-W452

Affected Products

Nextcloud Calendar

Red Os

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45150.json · Exploit
• 🔥 https://hackerone.com/reports/2058337 · Exploit
• https://github.com/nextcloud/calendar/pull/5358 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-45150 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-45150 · Security Note
• https://bdu.fstec.ru/vul/2023-07118 · Security Note
• https://vuldb.com/ru/?id.242309 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nextcloud-calendar-cve-2023-45150 · Note
• https://t.me/cibsecurity/72371 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1714051220824895791 · Twitter Post
• https://twitter.com/CVEnew/status/1713996721892528251 · Twitter Post