CVE-2022-24838: medium-severity vulnerability in nextcloud security-advisories
Command Injection in Appointment Emails for Nextcloud Calendar
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in Nextcloud Calendar allows attackers to inject malicious email commands by adding special characters to appointment email fields. An attacker can exploit this to send unauthorized emails or manipulate email delivery.
CWE-74 (Improper Neutralization of Special Elements) occurs in the appointment email endpoint where newlines and special characters in JSON email values are not sanitized before being passed to SMTP commands. An unauthenticated or low-privileged attacker can inject arbitrary SMTP directives via the RCPT TO field, potentially leading to unauthorized message relay or email interception.
In the same product, most dangerous first.