Medium severity · published Oct 16, 2023
CVE-2023-45150
Nextcloud calendar is a calendar app for the Nextcloud server platform
4.3
CVSS
0.5%
EPSS
No
On KEV
Description
Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended that the Nextcloud Calendar app is upgraded to 4.4.4. The only workaround for users unable to upgrade is to disable the calendar app.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Calendar · Nextcloud
1.0 before 4.4.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-45150
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-45150
Patch
https://github.com/nextcloud/calendar/pull/5358
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452
Exploit
https://hackerone.com/reports/2058337
More from Calendar
9.8
CVE-2022-24838
Nextcloud Calendar is a calendar application for the nextcloud framework
6.5
CVE-2025-66511
Nextcloud Calendar app used predictable proposal participant tokens
6.5
CVE-2023-48308
Nextcloud/Cloud is a calendar app for Nextcloud
5.7
CVE-2025-66550
Nextcloud Calendar attachments of local files are offered to downloaded
4.8
CVE-2018-3763
In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction