PT-2023-30769 · Nextcloud · Nextcloud Mail

Arianitisufi + 2 · Published 2023-11-21 · Updated 2023-11-30 · CVE-2023-48307

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions 1.13.0 through 2.2.7 Nextcloud Mail versions 2.2.8 is not affected, but versions prior to 3.3.0 are affected, so the correct range is: Nextcloud Mail versions 1.13.0 through 3.2.x

Description Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. An attacker can use an unprotected endpoint in the Mail app to perform a Server-Side Request Forgery (SSRF) attack.

Recommendations For Nextcloud Mail versions 1.13.0 through 2.2.7, update to version 2.2.8 or later. For Nextcloud Mail versions prior to 3.3.0, update to version 3.3.0. As a temporary workaround for all affected versions, consider disabling the mail app.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-48307

GHSA-4PP4-M8PH-2999

Affected Products

Nextcloud Mail

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/48xxx/CVE-2023-48307.json · Exploit
• https://github.com/nextcloud/mail/pull/8709 · Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4pp4-m8ph-2999 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-48307 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-48307 · Security Note
• https://t.me/cvenotify/61714 · Telegram Post
• https://hackerone.com/reports/1869714 · Note
• https://t.me/cvenotify/61030 · Telegram Post