CVE-2023-33182CWE-20

Nextcloud Contacts photos only sanitized if mime type is all lower case

published May 30, 2023

CVSS v3.1
0.0
EPSS
1%
Percentile
57.7
In the wild
Unconfirmed
What it is

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4

The record
Technical detail
CVSS v3.1
0.0 · NONE
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00848 · 57.7th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2023-05-30T04:58Z
EPSS history
Timeline
  • 30 MAY 04:58Z
    Nextcloud Contacts photos only sanitized if mime type is all lower case
    cvelistv5