A vulnerability was found in Nextcloud Calendar up to 4.5.2 (Calendar Software). It has been declared as problematic. This vulnerability affects an unknown code. The manipulation with an unknown input leads to a exposure of sensitive system information due to uncleared debug information vulnerability. The CWE definition for the vulnerability is CWE-1258. The hardware does not fully clear security-sensitive values, such as keys and intermediate values in cryptographic operations, when debug mode is entered. As an impact it is known to affect confidentiality. CVE summarizes:

Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3

The weakness was disclosed 12/22/2023. The advisory is shared for download at github.com. This vulnerability was named CVE-2023-48308 since 11/14/2023. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 4.5.3 eliminates this vulnerability.

The entries VDB-137089, VDB-137093, VDB-177222 and VDB-196930 are pretty similar.

Productinfo

Type

• Calendar Software

Vendor

• Nextcloud

Name

• Calendar

Version

• 4.5.0
• 4.5.1
• 4.5.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion