CVE-2023-23943CWE-918

Blind SSRF via server URL input in the Nextcloud Mail app

Medium · published February 6, 2023

CVSS v3.1
5.0
EPSS
1%
Percentile
59.9
In the wild
Unconfirmed
What it is

Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00919 · 59.9th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2023-02-06T20:18Z
EPSS history
Timeline
  • 06 FEB 20:18Z
    Blind SSRF via server URL input in the Nextcloud Mail app
    cvelistv5