CVE-2023-23943
published 2023-02-06CVE-2023-23943: Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal…
PriorityP418medium4.3CVSS 3.1
AVAACLPRNUINSUCLINAN
EPSS
0.92%
55.8th percentile
Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nextcloud | < 1.15.0 | 1.15.0 | |
| nextcloud | >= 2.2.0 < 2.2.2 | 2.2.2 | |
| nextcloud | security-advisories | < 1.15.0 | 1.15.0 |
| nextcloud | security-advisories | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No advisories linked to this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/nextcloud/mail/pull/7796https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r739-9pf6https://hackerone.com/reports/1736390https://hackerone.com/reports/1741525https://hackerone.com/reports/1746582https://github.com/nextcloud/mail/pull/7796https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r739-9pf6https://hackerone.com/reports/1736390https://hackerone.com/reports/1741525https://hackerone.com/reports/1746582
2023-02-06
Published