Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2023-23943: Blind SSRF via server URL input in the Nextcloud Mail app

CVE-2023-23943 · published 3 years ago

Summary

Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgrad...

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
nextcloud	mail	< 1.15.0 >= 2.2.0, < 2.2.2 `cpe:2.3:a:nextcloud:mail::::::::`

Original advisory text

Blind SSRF via server URL input in the Nextcloud Mail app

References

https://hackerone.com/reports/1736390 URL
https://hackerone.com/reports/1741525 URL
https://hackerone.com/reports/1746582 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23943... Vendor Advisory
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-23943 Vendor Advisory
https://github.com/nextcloud/mail/pull/7796 Patch

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.0 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-918Server-Side Request Forgery (SSRF)

Timeline

Published6 Feb 2023

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2023-23943 · NVD

CVE-2023-23943 · OSV

GHSA-8gcx-r739-9pf6 · GHSA

Track software like this

Free during beta