Medium severity · published Feb 6, 2023
CVE-2023-23944
Nextcloud mail is an email app for the nextcloud home server platform
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed. It is recommended that the Nextcloud Mail app is upgraded to 2.2.2. There are no known workarounds for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
Mail · Nextcloud
before 2.2.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-23944
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-23944
Patch
https://github.com/nextcloud/mail/pull/7797
Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g86r-x755-93f4
Permissions Required
https://hackerone.com/reports/1806275
More from Mail
9.8
CVE-2023-48307
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
9.8
CVE-2022-31132
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
8.1
CVE-2024-52508
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform
7.0
CVE-2020-8156
A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack
5.7
CVE-2024-52509
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform