CVE-2023-45150

Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended that the Nextcloud Calendar app is upgraded to 4.4.4. The only workaround for users unable to upgrade is to disable the calendar app.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://github.com/nextcloud/calendar/pull/5358	Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452	Vendor Advisory
https://hackerone.com/reports/2058337	Exploit Issue Tracking

Configurations

Configuration 1 (hide)

cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*

History

20 Oct 2023, 12:11

Type	Values Removed	Values Added
First Time		Nextcloud calendar Nextcloud
CPE		cpe:2.3:a:nextcloud:calendar::::::::
CWE	~~CWE-400~~	CWE-354
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.3
References	~~(MISC) https://github.com/nextcloud/calendar/pull/5358 -~~	(MISC) https://github.com/nextcloud/calendar/pull/5358 - Patch
References	~~(MISC) https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452 -~~	(MISC) https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452 - Vendor Advisory
References	~~(MISC) https://hackerone.com/reports/2058337 -~~	(MISC) https://hackerone.com/reports/2058337 - Exploit, Issue Tracking

16 Oct 2023, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-10-16 20:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-45150

Mitre link : CVE-2023-45150

CVE.ORG link : CVE-2023-45150

JSON object : View

Products Affected

nextcloud

calendar

CWE

CWE-354

Improper Validation of Integrity Check Value

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2023-45150", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2023-10-16T20:15:15.393", "references": [{"url": "https://github.com/nextcloud/calendar/pull/5358", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://hackerone.com/reports/2058337", "tags": ["Exploit", "Issue Tracking"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-354"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended that the Nextcloud Calendar app is upgraded to 4.4.4. The only workaround for users unable to upgrade is to disable the calendar app."}, {"lang": "es", "value": "Nextcloud calendar es una aplicaci\u00f3n de calendario para la plataforma del servidor Nextcloud. Debido a la falta de comprobaciones de condiciones previas, el servidor intentaba validar cadenas de cualquier longitud como direcciones de correo electr\u00f3nico incluso cuando se proporcionaban megabytes de datos, lo que eventualmente hac\u00eda que el servidor estuviera ocupado y no respondiera. Se recomienda actualizar la aplicaci\u00f3n Calendario Nextcloud a 4.4.4. El \u00fanico workaround para los usuarios que no pueden actualizar es desactivar la aplicaci\u00f3n de calendario."}], "lastModified": "2023-10-20T12:11:24.833", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC6A69AB-4972-431A-8734-0234D2734BAF", "versionEndExcluding": "4.4.4", "versionStartIncluding": "1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}