← Zuruck zu CVEs

CVE-2023-33182

NONE

0.0

Beschreibung

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4

CVE Details

CVSS v3.1 Bewertung0.0

SchweregradNONE

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht5/30/2023

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

nextcloud:contacts

Schwachen (CWE)

CWE-20

Referenzen

https://github.com/nextcloud/contacts/pull/3199(security-advisories@github.com)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-cx85-gcjx(security-advisories@github.com)

https://hackerone.com/reports/1789602(security-advisories@github.com)

https://github.com/nextcloud/contacts/pull/3199(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-cx85-gcjx(af854a3a-2127-422b-91ae-364da2661108)

https://hackerone.com/reports/1789602(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.