CVE-2023-33182 — Improper Input Validation in Contacts

CWE-20 — Improper Input Validation2 documents2 sources
Severity
4.3MEDIUMNVD
EPSS
0.2%
top 58.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Nextcloud ContactsNextcloud Security-advisories
Timeline
PublishedMay 30

Description

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶NVDnextcloud/contacts4.1.0 — 4.2.4+1
▶CVEListV5nextcloud/security-advisories>= 4.1.0, < 4.2.4, >= 5.0.0, < 5.0.3+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

1
CVEList
Nextcloud Contacts photos only sanitized if mime type is all lower case↗2023-05-30
▶
CVE-2023-33182 — Improper Input Validation in Contacts | cvebase