CVE-2024-37316
Nextcloud Calendar's event create can create attachments that link to other websites
Summary
Nextcloud Calendar's event create can create attachments that link to other websites
Original description
The description as published by the source.
Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a bad redirect for participants when clicked. It is recommended that the Nextcloud Calendar App is upgraded to 4.6.8 or 4.7.2.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web hackerone.com