PT-2023-30769 · Nextcloud · Nextcloud Mail

Arianitisufi + 2 · Publicado 2023-11-21 · Atualizado 2023-11-30 · CVE-2023-48307

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions 1.13.0 through 2.2.7 Nextcloud Mail versions 2.2.8 is not affected, but versions prior to 3.3.0 are affected, so the correct range is: Nextcloud Mail versions 1.13.0 through 3.2.x

Description Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. An attacker can use an unprotected endpoint in the Mail app to perform a Server-Side Request Forgery (SSRF) attack.

Recommendations For Nextcloud Mail versions 1.13.0 through 2.2.7, update to version 2.2.8 or later. For Nextcloud Mail versions prior to 3.3.0, update to version 3.3.0. As a temporary workaround for all affected versions, consider disabling the mail app.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2023-48307

GHSA-4PP4-M8PH-2999

Produtos afetados

Nextcloud Mail

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48307.json · Exploit
• https://github.com/nextcloud/mail/pull/8709 · Correção
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4pp4-m8ph-2999 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-48307 · Aviso do Fabricante
• https://t.me/cvenotify/61714 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-48307 · Nota de Segurança
• https://hackerone.com/reports/1869714 · Nota
• https://t.me/cvenotify/61030 · Publicação no Telegram