CVE-2023-33183

EPSS 0.18%
Published 30.05.2023 06:16:35
Last modified 21.11.2024 08:05:04
Source security-advisories@github.com
Teams watchlist Login
Open Login

Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.2.3

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Nextcloud ≫ Calendar Version < 3.5.5

Nextcloud ≫ Calendar Version >= 4.0.0 < 4.2.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.18%	0.405

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	2.8	1.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
security-advisories@github.com	2.6	1.2	1.4	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

CWE-285 Improper Authorization

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/nextcloud/calendar/pull/4938

Patch

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2792-2734-hr7j

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-33183

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-33183

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-33183

EUVD