CVE-2022-31132CWE-918

Unauthenticated SSRF in 3rd party module "cerdic/csstidy"

High · published August 4, 2022

CVSS v3.1
8.3
EPSS
1%
Percentile
53.5
In the wild
Unconfirmed
What it is

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css-tidy/css_optimiser.php`. Access to the minifier is unrestricted and access may lead to Server-Side Request Forgery (SSRF). It is recommendet to upgrade to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at `./vendor/cerdic/css-tidy/css_optimiser.php`

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00724 · 53.5th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2022-08-04T17:10Z
EPSS history
Timeline
  • 04 AUG 17:10Z
    Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
    cvelistv5