CVE-2023-33183

Error in calendar when booking an appointment reveals the full path of the website

State: Published
Severity: 2.6 Low
Published: May 30, 2023
Updated: Jan 10, 2025
Reserved: May 17, 2023

Description

Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.2.3

Scores

CVSS	Score	Vector	Source
3.1	2.6 Low	CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N	GitHub_M

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
security-advisoriesnextcloud	< 3.5.5Affected < 4.2.3Affected

References

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2792-2734-hr7j
https://github.com/nextcloud/calendar/pull/4938

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.