CVE-2022-31131 Ownership check missing when updating or deleting mail attachments in Nextcloud mail
Attackers can access or modify other users' mail attachments due to missing ownership checks in the Nextcloud Mail application.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-31131?
CVE-2022-31131 is a medium-severity missing authorization vulnerability in nextcloud security-advisories, published on 6 Jul 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Nextcloud mail is a Mail app for the Nextcloud home server product. Versions of Nextcloud mail prior to 1.12.2 were found to be missing user account ownership checks when performing tasks related to mail attachments. Attachments may have been exposed to incorrect system users. It is recommended that the Nextcloud Mail app is upgraded to 1.12.2. There are no known workarounds for this issue. ### Workarounds No workaround available ### References * [Pull request](https://github.com/nextcloud/mail/pull/6600) * [HackerOne](https://hackerone.com/reports/1579820) ### For more information If you have any questions or comments about this advisory: * Create a post in [nextcloud/security-advisories](https://github.com/nextcloud/security-advisories/discussions) * Customers: Open a support ticket at [support.nextcloud.com](https://support.nextcloud.com)
Which versions are affected by CVE-2022-31131?
It affects 1 product.
Products include Nextcloud Nextcloud Mail.
How do I fix CVE-2022-31131?
No fix has been published for CVE-2022-31131 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2022-31131 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-31131 exists.
Sources
Also known as GHSA-xhv7-5mhv-299j.