CVE-2023-33182

low-risk
Published 2023-05-30

Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is converted to a JavaScript blob (in memory data) that the Avatar can't render. Due to this constellation the missing sanitization does not seem to be exploitable. It is recommended that the Contacts app is upgraded to 5.0.3 or 4.2.4

Do I need to act?

-
0.19% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance

Affected Products (1)

Contacts

Affected Vendors

Nextcloud

References (6)

Patch https://github.com/nextcloud/contacts/pull/3199
Vendor Advisory https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-c...
Permissions Required https://hackerone.com/reports/1789602
Patch https://github.com/nextcloud/contacts/pull/3199
Vendor Advisory https://github.com/nextcloud/security-advisories/security/advisories/GHSA-hxr6-c...
Permissions Required https://hackerone.com/reports/1789602
13
/ 100
low-risk
Severity 7/34 · Low
Exploitability 1/34 · Minimal
Exposure 5/34 · Minimal