CVE-2023-45150: nextcloud calendar Uncontrolled Resource Consumption
Vulnerability summary
CVE-2023-45150 is a medium (CVSS 4.3) Uncontrolled Resource Consumption vulnerability in nextcloud calendar. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 39.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 16-10-2023PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
Nextcloud calendar is a calendar app for the Nextcloud server platform. Due to missing precondition checks the server was trying to validate strings of any length as email addresses even when megabytes of data were provided, eventually making the server busy and unresponsive. It is recommended that the Nextcloud Calendar app is upgraded to 4.4.4. The only workaround for users unable to upgrade is to disable the calendar app.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
+0.09 pp
From 0.39% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-354Improper Validation of Integrity Check ValueThe product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
Affected systems
Nextcloud2 products
- calendar≥ 1.0, < 4.4.4
- security-advisories≥ 1.0.0, < 4.4.4
1 vendor · 2 products
References
3 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-r936-8gwm-w452X Refsource CONFIRMVendor Advisory