CVE-2024-37316 — Improper Handling of Unexpected Data Type in Calendar

CWE-241 — Improper Handling of Unexpected Data Type2 documents2 sources

Severity

4.6MEDIUMNVD

EPSS

0.4%

top 37.70%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Nextcloud Calendar Nextcloud Security-advisories

Timeline

PublishedJun 14

Description

Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:NExploitability: 2.1 | Impact: 2.5

Affected Packages2 packages

▶NVDnextcloud/calendar4.3.0 — 4.6.8

▶CVEListV5nextcloud/security-advisories>= 4.3.0, < 4.6.8, >= 4.7.0, < 4.7.2+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

CVEList

Nextcloud Calendar's event create can create attachments that link to other websites↗2024-06-14

▶