Medium severity · published May 30, 2023
CVE-2023-33182
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing
4.3
CVSS
0.8%
EPSS
No
On KEV
Description
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Contacts · Nextcloud
4.1.0 before 4.2.4; 5.0.0 before 5.0.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33182
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33182
Patch
https://github.com/nextcloud/contacts/pull/3199
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-cx85-gcjx
Permissions Required
https://hackerone.com/reports/1789602
More from Contacts
5.4
CVE-2025-66554
Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing
5.4
CVE-2021-39221
Nextcloud is an open-source, self-hosted productivity platform
5.4
CVE-2020-8281
A missing file type check in Nextcloud Contacts 3.3.0 allows a malicious user to upload malicious SVG files to perform cross-site scripting (XSS) attacks
5.4
CVE-2020-8280
A missing file type check in Nextcloud Contacts 3.4.0 allows a malicious user to upload SVG files as PNG files to perform cross-site scripting (XSS) attacks
4.8
CVE-2018-3764
In Nextcloud Contacts before 2.1.2, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction