Medium severity · published May 30, 2023
CVE-2023-33183
Calendar app for Nextcloud easily sync events from various devices with your Nextcloud
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.2.3
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Calendar · Nextcloud
before 3.5.5; 4.0.0 before 4.2.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-33183
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-33183
Patch
https://github.com/nextcloud/calendar/pull/4938
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-2792-2734-hr7j
More from Calendar
9.8
CVE-2022-24838
Nextcloud Calendar is a calendar application for the nextcloud framework
6.5
CVE-2025-66511
Nextcloud Calendar app used predictable proposal participant tokens
6.5
CVE-2023-48308
Nextcloud/Cloud is a calendar app for Nextcloud
5.7
CVE-2025-66550
Nextcloud Calendar attachments of local files are offered to downloaded
4.8
CVE-2018-3763
In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction