CVE-2025-66511
Nextcloud Calendar app used predictable proposal participant tokens
概要
Nextcloud Calendar app used predictable proposal participant tokens
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Nextcloud Calendar is a calendar app for Nextcloud. Prior to 6.0.3, the Calendar app generates participant tokens for meeting proposals using a hash function, allowing an attacker to compute valid participant tokens, which allowed them to request details and submit dates in meeting proposals. The tokens are not purely random generated. This vulnerability is fixed in 6.0.3.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web hackerone.com