CVE-2022-31132: Unauthenticated SSRF in 3rd party module "cerdic/csstidy"

Q: What is the vulnerability ID of this vulnerability?

The vulnerability ID is CVE-2022-31132.

Q: What is the severity of CVE-2022-31132?

The severity of CVE-2022-31132 is critical.

Q: Which software is affected by CVE-2022-31132?

Nextcloud Mail versions up to 1.12.8 and versions between 1.13.0 and 1.13.6 are affected by CVE-2022-31132.

Q: What is the impact of CVE-2022-31132?

CVE-2022-31132 can lead to Server-Side Request Forgery (SSRF).

Q: How can I fix CVE-2022-31132?

To fix CVE-2022-31132, update Nextcloud Mail to a version higher than 1.13.6.

Published Aug 4, 2022

Updated

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path ./vendor/cerdic/css-tidy/cssoptimiser.php. Access to the minifier is unrestricted and access may lead to Server-Side Request Forgery (SSRF). It is recommendet to upgrade to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at ./vendor/cerdic/css-tidy/cssoptimiser.php

Affected Software

2 affected components

Nextcloud Mail<1.12.8

Nextcloud Mail>=1.13.0<1.13.6

Event History

Aug 4, 2022

CVE Published

via MITRE·05:10 PM

Data Sourced

via MITRE·05:10 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID of this vulnerability?

The vulnerability ID is CVE-2022-31132.

What is the severity of CVE-2022-31132?

The severity of CVE-2022-31132 is critical.

Which software is affected by CVE-2022-31132?

Nextcloud Mail versions up to 1.12.8 and versions between 1.13.0 and 1.13.6 are affected by CVE-2022-31132.

What is the impact of CVE-2022-31132?

CVE-2022-31132 can lead to Server-Side Request Forgery (SSRF).

How can I fix CVE-2022-31132?