Medium severity · published Feb 6, 2023
CVE-2023-23943
Nextcloud mail is an email app for the nextcloud home server platform
4.3
CVSS
0.9%
EPSS
No
On KEV
Description
Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mail · Nextcloud
before 1.15.0; 2.2.0 before 2.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23943
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23943
Patch
https://github.com/nextcloud/mail/pull/7796
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r739-9pf6
Exploit
https://hackerone.com/reports/1736390
Exploit
https://hackerone.com/reports/1741525
Exploit
https://hackerone.com/reports/1746582
More from Mail
9.8
CVE-2023-48307
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.1
CVE-2024-52508
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
7.0
CVE-2020-8156
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack
6.5
CVE-2023-23944
Nextcloud mail is an email app for the nextcloud home server platform