Password disclosure in log file when providing incorrect additional data on initial setup of Mail App

Description

Impact

Complete access to a IMAP account and possibly if the password is the same for the NC account, complete account control.

Patches

It is recommended that the Nextcloud Mail is upgraded to 1.12.1

Workarounds

Provide only correct data on the setup so no error is being logged.

References

• Pull request
• Public ticket
• HackerOne

For more information

If you have any questions or comments about this advisory:

• Create a post in nextcloud/security-advisories
• Customers: Open a support ticket at support.nextcloud.com