PT-2023-19946 · Nextcloud · Nextcloud Mail

Ctulhu · Publicado 2023-02-13 · Atualizado 2023-02-22 · CVE-2023-25160

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 2.2.1 Nextcloud Mail versions prior to 1.14.5 Nextcloud Mail versions prior to 1.12.9 Nextcloud Mail versions prior to 1.11.8

Description Nextcloud Mail is an email app for the Nextcloud home server platform. An attacker can access the mail box by ID, getting the subjects and the first characters of the emails.

Recommendations For Nextcloud 25, upgrade to Mail 2.2.1 to receive a patch. For Nextcloud 22-24, upgrade to Mail 1.14.5 to receive a patch. For Nextcloud 21, upgrade to Mail 1.12.9 to receive a patch. For Nextcloud 20, upgrade to Mail 1.11.8 to receive a patch.

Exploit

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2023-25160

GHSA-M45F-R5GH-H6CX

Produtos afetados

Nextcloud Mail

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25160.json · Exploit
• https://github.com/nextcloud/mail/pull/7740 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m45f-r5gh-h6cx · Aviso do Fabricante
• https://hackerone.com/reports/1784681 · Nota
• https://osv.dev/vulnerability/CVE-2023-25160 · Aviso do Fabricante
• https://t.me/cibsecurity/58035 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-25160 · Nota de Segurança