PT-2024-27473 · Nextcloud · Nextcloud Calendar

Wwwshellcodeit · Published 2024-06-14 · Updated 2024-08-19 · CVE-2024-37316

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Calendar versions prior to 4.6.8 Nextcloud Calendar versions prior to 4.7.2

Description The issue allows authenticated users to create an event with manipulated attachment data, leading to a bad redirect for participants when clicked.

Recommendations For versions prior to 4.6.8, upgrade to version 4.6.8. For versions prior to 4.7.2, upgrade to version 4.7.2.

Exploit

Fix

Weakness Enumeration

CWE-241

Related Identifiers

CVE-2024-37316

GHSA-2R7Q-VFMV-79QF

Affected Products

Nextcloud Calendar

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37316.json · Exploit
• https://github.com/nextcloud/calendar/pull/5966 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-37316 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37316 · Vendor Advisory
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf · Note
• https://twitter.com/linuxpatch/status/1801662479774130335 · Twitter Post
• https://hackerone.com/reports/2457588 · Note
• https://twitter.com/CVEnew/status/1801673788993769771 · Twitter Post