CVE-2023-48308 - Vulnerability Details - OpenCVE

Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Nextcloud	Calendar

Configuration 1 [-]

cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/nextcloud/calendar/pull/5553
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8

History

Wed, 27 Nov 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-12-21T23:12:45.538Z

Updated: 2024-11-27T15:46:01.287Z

Reserved: 2023-11-14T17:41:15.572Z

Link: CVE-2023-48308

Vulnrichment

Updated: 2024-08-02T21:23:39.497Z

NVD

Status : Modified

Published: 2023-12-22T00:15:34.650

Modified: 2024-11-21T08:31:27.480

Link: CVE-2023-48308

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-48308", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-11-14T17:41:15.572Z", "datePublished": "2023-12-21T23:12:45.538Z", "dateUpdated": "2024-11-27T15:46:01.287Z"}, "containers": {"cna": {"title": "Calendar app returns full stacktrace when an error happens while editing appointment", "problemTypes": [{"descriptions": [{"cweId": "CWE-1258", "lang": "en", "description": "CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8"}, {"name": "https://github.com/nextcloud/calendar/pull/5553", "tags": ["x_refsource_MISC"], "url": "https://github.com/nextcloud/calendar/pull/5553"}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"version": ">= 3.0.0, < 4.5.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-21T23:12:45.538Z"}, "descriptions": [{"lang": "en", "value": "Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3\n"}], "source": {"advisory": "GHSA-fv3c-qvjr-5rv8", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:23:39.497Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8"}, {"name": "https://github.com/nextcloud/calendar/pull/5553", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/nextcloud/calendar/pull/5553"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-27T15:45:51.881721Z", "id": "CVE-2023-48308", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-27T15:46:01.287Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8", "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/nextcloud/calendar/pull/5553", "name": "https://github.com/nextcloud/calendar/pull/5553", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T21:23:39.497Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-48308", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-27T15:45:51.881721Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-27T15:45:56.753Z"}}], "cna": {"title": "Calendar app returns full stacktrace when an error happens while editing appointment", "source": {"advisory": "GHSA-fv3c-qvjr-5rv8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "nextcloud", "product": "security-advisories", "versions": [{"status": "affected", "version": ">= 3.0.0, < 4.5.3"}]}], "references": [{"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8", "name": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nextcloud/calendar/pull/5553", "name": "https://github.com/nextcloud/calendar/pull/5553", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3\n"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1258", "description": "CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2023-12-21T23:12:45.538Z"}}}, "cveMetadata": {"cveId": "CVE-2023-48308", "state": "PUBLISHED", "dateUpdated": "2024-11-27T15:46:01.287Z", "dateReserved": "2023-11-14T17:41:15.572Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2023-12-21T23:12:45.538Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A9A0474-9EBE-4B34-8517-0F673B93C50C", "versionEndExcluding": "4.5.3", "versionStartIncluding": "3.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3\n"}, {"lang": "es", "value": "Nextcloud/Cloud es una aplicaci\u00f3n de calendario para Nextcloud. Un atacante puede obtener acceso al seguimiento de pila y a las rutas internas del servidor al generar una excepci\u00f3n al editar una cita del calendario. Se recomienda actualizar la aplicaci\u00f3n Calendario Nextcloud a 4.5.3"}], "id": "CVE-2023-48308", "lastModified": "2024-11-21T08:31:27.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.5, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-22T00:15:34.650", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/nextcloud/calendar/pull/5553"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/nextcloud/calendar/pull/5553"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-fv3c-qvjr-5rv8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1258"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-212"}], "source": "nvd@nist.gov", "type": "Primary"}]}