Skip to content
CVE PROGRAM SOURCE RECORD3.5 Low

CVE-2023-33184

Blind SSRF in the Nextcloud Mail app on avatar endpoint

Description

Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nextcloud security-advisories

  • < 1.15.3affected
  • < 2.2.5affected
  • < 3.02affected

References