CVE-2023-45660

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-456617.1stb_image is a single file MIT licensed library for processing images. A crafted image file may trigger out of bounds memcpy read in `stbi__CVE-2023-456628.1stb_image is a single file MIT licensed library for processing images. When `stbi_set_flip_vertically_on_load` is set to `TRUE` and `req_com CVE-2023-456635.5stb_image is a single file MIT licensed library for processing images. The stbi__getn function reads a specified number of bytes from contex CVE-2023-456648.8stb_image is a single file MIT licensed library for processing images. A crafted image file can trigger `stbi__load_gif_main_outofmem` attem CVE-2023-456669.8stb_image is a single file MIT licensed library for processing images. It may look like `stbi__load_gif_main` doesn’t give guarantees about CVE-2023-456677.5stb_image is a single file MIT licensed library for processing images. If `stbi__load_gif_main` in `stbi_load_gif_from_memory` fails it ret CVE-2023-456695.3WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to impro CVE-2023-456706.8Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the `config/save` and `config/set` endpoints of Frigate do CVE-2023-456714.7Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in CVE-2023-456727.5Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in CVE-2023-456739.0Joplin is a free, open source note taking and to-do application. A remote code execution (RCE) vulnerability in affected versions allows cli CVE-2023-456746.5Farmbot-Web-App is a web control interface for the Farmbot farm automation platform. An SQL injection vulnerability was found in FarmBot's w