← Back to CVEs

CVE-2023-33182

NONE

0.0

Description

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4

CVE Details

CVSS v3.1 Score0.0

SeverityNONE

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published5/30/2023

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

nextcloud:contacts

Weaknesses (CWE)

CWE-20

References

https://github.com/nextcloud/contacts/pull/3199(security-advisories@github.com)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-cx85-gcjx(security-advisories@github.com)

https://hackerone.com/reports/1789602(security-advisories@github.com)

https://github.com/nextcloud/contacts/pull/3199(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-cx85-gcjx(af854a3a-2127-422b-91ae-364da2661108)

https://hackerone.com/reports/1789602(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.