Vulnerability Description
Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3.
CVSS Score
3.5
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nextcloud | >= 1.13.0, < 1.15.3 |
Related Weaknesses (CWE)
References
- https://github.com/nextcloud/mail/pull/8275Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9Vendor Advisory
- https://hackerone.com/reports/1913095Issue Tracking
- https://github.com/nextcloud/mail/pull/8275Patch
- https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9Vendor Advisory
- https://hackerone.com/reports/1913095Issue Tracking
FAQ
What is CVE-2023-33184?
CVE-2023-33184 is a vulnerability with a CVSS score of 3.5 (LOW). Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2...
How severe is CVE-2023-33184?
CVE-2023-33184 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-33184?
Check the references section above for vendor advisories and patch information. Affected products include: Nextcloud Mail.