CVE-2023-33184

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
May 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-331855.4Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service.CVE-2023-331866.1Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote woCVE-2023-331876.5Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html inpCVE-2023-331885.5Omni-notes is an open source note-taking application for Android. The Omni-notes Android app had an insufficient path validation vulnerabiliCVE-2023-331899.8Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by PoCVE-2023-33195.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iDisplay PlatPlay DS allows Stored XSSCVE-2023-331909.8Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an impCVE-2023-331918.8Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurCVE-2023-331927.5ntpd-rs is an NTP implementation written in Rust. ntpd-rs does not validate the length of NTS cookies in received NTP packets to the server.CVE-2023-331939.1Emby Server is a user-installable home media server which stores and organizes a user's media files of virtually any format and makes them aCVE-2023-331944.8Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validatCVE-2023-331956.1Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched i
CVE-2023-33184: Medium severity, CVSS 5.3 | Vulnix