CVE-2023-45660: Require strict cookies for image proxy requests in Nextcloud Mail
Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-45660?
CVE-2023-45660 is a vulnerability in Nextcloud Mail, an email app for the Nextcloud home server platform, that allows an attacker to abuse the proxy endpoint to perform a denial of service attack on a third-party server.
How does CVE-2023-45660 affect Nextcloud Mail?
CVE-2023-45660 affects Nextcloud Mail by allowing an attacker to exploit a missing check of origin, target, and cookies to perform a denial of service attack.
What is the severity of CVE-2023-45660?
CVE-2023-45660 has a severity level of medium, with a CVSS score of 4.3.
How can I fix CVE-2023-45660 in Nextcloud Mail?
To fix CVE-2023-45660 in Nextcloud Mail, it is recommended to upgrade to version 2.2.8 or 3.3.0.
Where can I find more information about CVE-2023-45660?
You can find more information about CVE-2023-45660 on the following references: [GitHub Pull Request](https://github.com/nextcloud/mail/pull/8459), [Nextcloud Security Advisories](https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8j9x-fmww-qr37), [HackerOne report](https://hackerone.com/reports/1895874).