Skip to content
CVE PROGRAM SOURCE RECORD4.6 Medium

CVE-2024-37316

Nextcloud Calendar's event create can create attachments that link to other websites

Description

Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nextcloud security-advisories

  • >= 4.3.0, < 4.6.8affected
  • >= 4.7.0, < 4.7.2affected

References