CVE-2023-48308: low-severity vulnerability in nextcloud security-advisories
Calendar app returns full stacktrace when an error happens while editing appointment
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
When editing a calendar appointment in Nextcloud Calendar, an error can expose the application's internal error details and server paths to attackers. This information leak can help attackers understand the system's structure and find other vulnerabilities.
The Nextcloud Calendar app fails to properly sanitize error messages during appointment editing, returning full stack traces that disclose internal file paths and system information. An attacker can trigger this information disclosure by manipulating appointment data, requiring only basic user interaction with the calendar feature.
In the same product, most dangerous first.