CVE-2023-48307: Nextcloud Mail app vulnerable to Server-Side Request Forgery
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for this issue. As a workaround, disable the mail app.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2023-48307?
CVE-2023-48307 is a vulnerability in the Nextcloud Mail app that allows an attacker to perform a Server-Side Request Forgery (SSRF) attack through an unprotected endpoint.
How does the Nextcloud Mail app vulnerability work?
The vulnerability in the Nextcloud Mail app allows an attacker to abuse an unprotected endpoint to make arbitrary HTTP requests, leading to potential SSRF attacks.
Which versions of the Nextcloud Mail app are affected by CVE-2023-48307?
Versions 1.13.0 to 2.2.8 and versions 3.0.0 to 3.3.0 of the Nextcloud Mail app are affected by CVE-2023-48307.
How severe is the CVE-2023-48307 vulnerability?
The severity of CVE-2023-48307 is rated as critical with a CVSS score of 9.8.
How can I mitigate the Nextcloud Mail app vulnerability?
To mitigate the vulnerability, it is recommended to update the Nextcloud Mail app to version 2.2.8 or 3.3.0, which contain patches for CVE-2023-48307.