Lucene search

[email protected]NVD:CVE-2023-25160

HistoryFeb 13, 2023 - 9:15 p.m.

CVE-2023-25160

2023-02-1321:15:14

CWE-639

[email protected]

web.nvd.nist.gov

nextcloud mail

unauthorized access

upgrade

patch

cve-2023-25160

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

38.9%

JSON

Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for Nextcloud 22-24, Mail 1.12.9 for Nextcloud 21, or Mail 1.11.8 for Nextcloud 20 to receive a patch. No known workarounds are available.

Affected configurations

Nvd

Node

nextcloudmailRange<1.11.8

nextcloudmailRange1.12.0–1.12.9

nextcloudmailRange1.13.0–1.14.5

nextcloudmailRange2.0.0–2.2.1

VendorProductVersionCPE
nextcloudmail*cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
nextcloud	mail	*	cpe:2.3:a:nextcloud:mail::::::::

References

github.com/nextcloud/mail/pull/7740

github.com/nextcloud/security-advisories/security/advisories/GHSA-m45f-r5gh-h6cx

hackerone.com/reports/1784681

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

38.9%

JSON

Related for NVD:CVE-2023-25160

cvelist1 nextcloud1 prion1 osv1 cve1