CVE-2023-48307 Nextcloud Mail app vulnerable to Server-Side Request Forgery
An attacker can exploit an unprotected endpoint in the Nextcloud Mail app to perform Server-Side Request Forgery attacks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-48307?
CVE-2023-48307 is a low-severity server-side request forgery vulnerability in nextcloud security-advisories, published on 21 Nov 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for this issue. As a workaround, disable the mail app.
Weakness: CWE-918
Which versions are affected by CVE-2023-48307?
It affects 1 product.
Products include Nextcloud Mail.
How do I fix CVE-2023-48307?
No fix has been published for CVE-2023-48307 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2023-48307 being exploited?
There is no known exploitation of CVE-2023-48307 in the wild and no public exploit code.
Other vulnerabilities in nextcloud security-advisories
- CVE-2021-32652 Missing permission check on email metadata retrieval
- CVE-2022-31132 Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
- CVE-2024-52508 Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers
- CVE-2023-23943 Blind SSRF via server URL input in the Nextcloud Mail app
- CVE-2023-45660 Require strict cookies for image proxy requests in Nextcloud Mail
Sources
Also known as GHSA-4pp4-m8ph-2999.