PT-2023-24201 · Nextcloud+1 · Nextcloud Mail+1

Drinndrecaj · Publicado 2023-05-27 · Atualizado 2024-11-20 · CVE-2023-33184

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 1.15.3 Nextcloud Mail versions prior to 2.2.5 Nextcloud Mail versions prior to 3.02

Description A blind SSRF attack in Nextcloud Mail allowed sending GET requests to services running in the same web server.

Recommendations For versions prior to 1.15.3, update to version 1.15.3. For versions prior to 2.2.5, update to version 2.2.5. For versions prior to 3.02, update to version 3.02.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2023-33184

GHSA-8GPH-9895-W564

Produtos afetados

Nextcloud Mail

Red Os

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33184.json · Exploit
• https://github.com/nextcloud/mail/pull/8275 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9895-w564 · Aviso do Fabricante
• https://t.me/cvenotify/51269 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-33184 · Aviso do Fabricante
• https://t.me/cvenotify/51645 · Publicação no Telegram
• https://t.me/cvenotify/102271 · Publicação no Telegram
• https://hackerone.com/reports/1913095 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-nextcloud-mail-cve-2023-33184 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-33184 · Nota de Segurança