CVE-2023-45660

Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
GitHub_MCNA
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 33%
VendorProductVersion
nextcloudmail
2.2.0 ≤
𝑥
< 2.2.8
nextcloudmail
3.0.0 ≤
𝑥
< 3.3.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/nextcloud/mail/pull/8459
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8j9x-fmww-qr37
https://hackerone.com/reports/1895874
https://github.com/nextcloud/mail/pull/8459
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8j9x-fmww-qr37
https://hackerone.com/reports/1895874