CVE-2019-5449

MEDIUM

Nextcloud Server < 15.0.1 - Unauthorized Calendar Event Name Disclosure

Title source: llm

Description

A missing check in the Nextcloud Server prior to version 15.0.1 causes leaking of calendar event names when adding or modifying confidential or private events.

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://hackerone.com/reports/476615

Scores

CVSS v3 4.3

EPSS 0.0030

EPSS Percentile 53.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE

CWE-862 CWE-287

Status published

Products (1)

nextcloud/nextcloud_server < 15.0.1

Published Jul 30, 2019

Tracked Since Feb 18, 2026