CVE-2023-33183 Error in calendar when booking an appointment reveals the full path of the website
An attacker can obtain internal website paths when the SMTP server is unavailable, potentially aiding further attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-33183?
CVE-2023-33183 is a low-severity vulnerability in nextcloud security-advisories, published on 30 May 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed when the SMTP server is unavailable. It is recommended that the Calendar app is updated to 3.5.5 or 4.2.3
Weakness: CWE-285
Which versions are affected by CVE-2023-33183?
It affects 1 product.
Products include Nextcloud Calendar.
How do I fix CVE-2023-33183?
No fix has been published for CVE-2023-33183 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-33183 being exploited?
There is no known exploitation of CVE-2023-33183 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2025-66550 Nextcloud Calendar attachments of local files are offered to downloaded
- CVE-2022-24838 Command Injection in Appointment Emails for Nextcloud Calendar
- CVE-2025-66511 Nextcloud Calendar app used predictable proposal participant tokens
- CVE-2018-3763 Cross-site scripting in Nextcloud Calendar application
- CVE-2024-37316 Nextcloud Calendar's event create can create attachments that link to other websites
Sources
Also known as GHSA-2792-2734-hr7j.