Medium severity · published Feb 6, 2023
CVE-2023-23943
Blind SSRF via server URL input in the Nextcloud Mail app
4.3
CVSS
0.9%
EPSS
No
On KEV
Description
Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
security-advisories · nextcloud
>= 2.0.0, < 2.2.2; < 1.15.0 · source: vendor
MA
Mail · Nextcloud
before 1.15.0; 2.2.0 before 2.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23943
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23943
Patch
https://github.com/nextcloud/mail/pull/7796
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r739-9pf6
Exploit
https://hackerone.com/reports/1736390
Exploit
https://hackerone.com/reports/1741525
Exploit
https://hackerone.com/reports/1746582
More from security-advisories
9.8
CVE-2024-22212
Nextcloud global site selector authentication bypass
9.8
CVE-2023-49792
Bruteforce protection can be bypassed with misconfigured proxy
9.8
CVE-2023-48307
Nextcloud Mail app vulnerable to Server-Side Request Forgery
9.8
CVE-2023-48306
Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRF
9.8
CVE-2023-32074
Nextcloud user_oidc app is missing brute force protection