CVE-2024-37316

Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.6 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
GitHub_MCNA
4.6 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CISA-ADPADP
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
VendorProductVersion
nextcloudcalendar
4.3.0 ≤
𝑥
< 4.6.8
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/nextcloud/calendar/pull/5966
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf
https://hackerone.com/reports/2457588
https://github.com/nextcloud/calendar/pull/5966
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf
https://hackerone.com/reports/2457588