CVE-2024-37316 - OpenCVE

Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Nextcloud	Calendar

Configuration 1 [-]

cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/nextcloud/calendar/pull/5966
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf
https://hackerone.com/reports/2457588

History

Mon, 19 Aug 2024 16:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Nextcloud Nextcloud calendar
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:nextcloud:calendar::::::::
Vendors & Products		Nextcloud Nextcloud calendar

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-06-14T15:23:12.705Z

Updated: 2024-08-02T03:50:56.106Z

Reserved: 2024-06-05T20:10:46.498Z

Link: CVE-2024-37316

Vulnrichment

Updated: 2024-07-12T19:04:03.246Z

NVD

Status : Analyzed

Published: 2024-06-14T16:15:11.707

Modified: 2024-08-19T15:31:28.043

Link: CVE-2024-37316

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-37316", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-06-05T20:10:46.498Z", "datePublished": "2024-06-14T15:23:12.705Z", "dateUpdated": "2024-08-02T03:50:56.106Z"}, "containers": {"cna": {"title": "Nextcloud Calendar's event create can create attachments that link to other websites", "problemTypes": [{"descriptions": [{"cweId": "CWE-241", "lang": "en", "description": "CWE-241: Improper Handling of Unexpected Data Type", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf"}, {"name": "https://github.com/nextcloud/calendar/pull/5966", "tags": ["x_refsource_MISC"], "url": "https://github.com/nextcloud/calendar/pull/5966"}, {"name": "https://hackerone.com/reports/2457588", "tags": ["x_refsource_MISC"], "url": "https://hackerone.com/reports/2457588"}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"version": ">= 4.3.0, < 4.6.8", "status": "affected"}, {"version": ">= 4.7.0, < 4.7.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-14T15:23:12.705Z"}, "descriptions": [{"lang": "en", "value": "Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2."}], "source": {"advisory": "GHSA-2r7q-vfmv-79qf", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-12T19:03:58.800051Z", "id": "CVE-2024-37316", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-12T19:04:06.344Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:50:56.106Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf"}, {"name": "https://github.com/nextcloud/calendar/pull/5966", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/nextcloud/calendar/pull/5966"}, {"name": "https://hackerone.com/reports/2457588", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://hackerone.com/reports/2457588"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-37316", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-12T19:03:58.800051Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-12T19:04:03.246Z"}}], "cna": {"title": "Nextcloud Calendar's event create can create attachments that link to other websites", "source": {"advisory": "GHSA-2r7q-vfmv-79qf", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": ">= 4.3.0, < 4.6.8"}, {"status": "affected", "version": ">= 4.7.0, < 4.7.2"}]}], "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf", "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nextcloud/calendar/pull/5966", "name": "https://github.com/nextcloud/calendar/pull/5966", "tags": ["x_refsource_MISC"]}, {"url": "https://hackerone.com/reports/2457588", "name": "https://hackerone.com/reports/2457588", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-241", "description": "CWE-241: Improper Handling of Unexpected Data Type"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-06-14T15:23:12.705Z"}}}, "cveMetadata": {"cveId": "CVE-2024-37316", "state": "PUBLISHED", "dateUpdated": "2024-07-12T19:04:06.344Z", "dateReserved": "2024-06-05T20:10:46.498Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-06-14T15:23:12.705Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*", "matchCriteriaId": "0C6E9F6A-219B-4C55-8567-EC6A671D0C3B", "versionEndExcluding": "4.6.8", "versionStartIncluding": "4.3.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2."}, {"lang": "es", "value": "Nextcloud Calendar es una aplicaci\u00f3n de calendario para Nextcloud. Los usuarios autenticados podr\u00edan crear un evento con datos adjuntos manipulados que provoquen una mala redirecci\u00f3n para los participantes cuando se haga clic en ellos. Se recomienda actualizar la aplicaci\u00f3n Calendario de Nextcloud a 4.6.8 o 4.7.2."}], "id": "CVE-2024-37316", "lastModified": "2024-08-19T15:31:28.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-06-14T16:15:11.707", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/nextcloud/calendar/pull/5966"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2r7q-vfmv-79qf"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://hackerone.com/reports/2457588"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-241"}], "source": "security-advisories@github.com", "type": "Secondary"}]}