Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.8
CVE-2018-3763: Nextcloud Calendar allows admin code injection
CVE-2018-3763 · published 8 years ago
Summary
The calendar app in Nextcloud (versions before 1.5.8 and 1.6.1) does not properly clean group names entered for the autocomplete feature. This lets an administrator or group manager place malicious code that could run when others view the calendar. Update the app to the latest version or restrict admin access to protect users.
What to do
- Update nextcloud calendar to version 1.5.8 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| nextcloud | calendar |
< 1.5.8 1.6.0 cpe:2.3:a:nextcloud:calendar:*:*:*:*:*:*:*:* |
Original advisory text
In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only...
In Nextcloud Calendar before 1.5.8 and 1.6.1, a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names, hence malicious search results could only be crafted by privileged users like admins or group admins.
References
- https://nextcloud.com/security/advisory/?id=nc-sa-2018-004 Broken Link Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published5 Jul 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-3763 · NVD
Track software like this
Free during beta