CVE-2017-0895
Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and...
Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.
- Record
CVE-2017-0895- CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:P/I:N/A:N - Weakness
- CWE-285, CWE-200
- Updated
- 2026-11-02
CVE List No score
Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.
- Record
CVE-2017-0895- Weakness
- CWE-285
- Updated
- 2026-11-02
EUVDEUVD-2017-1248 No score
Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.
- Record
EUVD-2017-1248- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mc2j-762j-c5hj
Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and...
Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.
- Record
GHSA-mc2j-762j-c5hj- CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-285
- Updated
- 2026-11-02
OSV
Nextcloud Server before 10.0.4 and 11.0.2 are vulnerable to disclosure of calendar and addressbook names to other logged-in users. Note that no actual content of the calendar and addressbook has been disclosed.
- Record
CVE-2017-0895- CVSS 3.0
- 3.5 Low
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-0895 is a low vulnerability (CVSS 3.5) in Hackerone Nextcloud Server, published May 8, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. No source names a fixed version.