CVE-2023-33184

EUVD-2023-37367
Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
GitHub_MCNA
3.5 LOW
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 36%
Affected Products (NVD)
VendorProductVersion
nextcloudmail
1.13.0 ≤
𝑥
< 1.15.3
nextcloudmail
2.2.0 ≤
𝑥
< 2.2.5
nextcloudmail
2.3.0 ≤
𝑥
< 3.0.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/nextcloud/mail/pull/8275
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9895-w564
https://hackerone.com/reports/1913095
https://github.com/nextcloud/mail/pull/8275
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9895-w564
https://hackerone.com/reports/1913095