CVE-2022-24838

    Dashboard / Vulnerabilities / CVE-2022-24838

    CVE-2022-24838

    Published: 11 Apr 2022Last Modified: 12 Aug 2026

    Summary: Command Injection in Appointment Emails for Nextcloud Calendar

    Details: Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the `RCPT TO:<BOOKING USER'S EMAIL> ` SMTP command and begin injecting arbitrary SMTP commands. It is recommended that Calendar is upgraded to 3.2.2. There are no workaround available.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24838.json, https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8xv5-4855-24qf, https://nvd.nist.gov/vuln/detail/CVE-2022-24838, https://github.com/nextcloud/calendar/commit/7b70edfb8a0fcf0926f613ababcbd56c6ecd9f35, https://github.com/nextcloud/calendar/pull/4073

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -623c6a6037fca9a80475b73087f19dd9157b3973

    Affected versions

    v3.2.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-24838 | CVE-DB