← Retour aux CVEs

CVE-2023-33182

NONE

0.0

Description

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4

Details CVE

Score CVSS v3.10.0

SeveriteNONE

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie5/30/2023

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

nextcloud:contacts

Faiblesses (CWE)

CWE-20

References

https://github.com/nextcloud/contacts/pull/3199(security-advisories@github.com)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-cx85-gcjx(security-advisories@github.com)

https://hackerone.com/reports/1789602(security-advisories@github.com)

https://github.com/nextcloud/contacts/pull/3199(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-cx85-gcjx(af854a3a-2127-422b-91ae-364da2661108)

https://hackerone.com/reports/1789602(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.