PT-2023-19946 · Nextcloud · Nextcloud Mail

Ctulhu · Published 2023-02-13 · Updated 2023-02-22 · CVE-2023-25160

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 2.2.1 Nextcloud Mail versions prior to 1.14.5 Nextcloud Mail versions prior to 1.12.9 Nextcloud Mail versions prior to 1.11.8

Description Nextcloud Mail is an email app for the Nextcloud home server platform. An attacker can access the mail box by ID, getting the subjects and the first characters of the emails.

Recommendations For Nextcloud 25, upgrade to Mail 2.2.1 to receive a patch. For Nextcloud 22-24, upgrade to Mail 1.14.5 to receive a patch. For Nextcloud 21, upgrade to Mail 1.12.9 to receive a patch. For Nextcloud 20, upgrade to Mail 1.11.8 to receive a patch.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-25160

GHSA-M45F-R5GH-H6CX

Affected Products

Nextcloud Mail

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/25xxx/CVE-2023-25160.json · Exploit
• https://github.com/nextcloud/mail/pull/7740 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m45f-r5gh-h6cx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-25160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-25160 · Security Note
• https://hackerone.com/reports/1784681 · Note
• https://t.me/cibsecurity/58035 · Telegram Post