CVE-2023-48307

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for this issue. As a workaround, disable the mail app.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
nextcloud	security-advisories	>= 1.13.0, < 2.2.8; >= 3.1.0, < 3.3.0

References

https://github.com/nextcloud/mail/pull/8709Issue Tracking, Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4pp4-m8ph-2999Vendor Advisory
https://hackerone.com/reports/1869714Permissions Required
https://github.com/nextcloud/mail/pull/8709Issue Tracking, Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4pp4-m8ph-2999Vendor Advisory
https://hackerone.com/reports/1869714Permissions Required

Timeline

Published: Nov 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-483086.5Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating CVE-2023-483095.3NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware author CVE-2023-48319.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncode Ncep allows SQL Injection.This i CVE-2023-483107.5TestingPlatform is a testing platform for Internet Security Standards. Prior to version 2.1.1, user input is not filtered correctly. Nmap op CVE-2023-483114.3dockerspawner is a tool to spawn JupyterHub single user servers in Docker containers. Users of JupyterHub deployments running DockerSpawner CVE-2023-483129.8capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability whi CVE-2023-483136.1Umbraco is an ASP.NET content management system (CMS). Starting in 10.0.0 and prior to versions 10.8.1 and 12.3.4, Umbraco contains a cross CVE-2023-483146.1Collabora Online is a collaborative online office suite based on LibreOffice technology. Users of Nextcloud with Collabora Online Built-in C CVE-2023-483159.8Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can caus CVE-2023-483169.8Azure RTOS NetX Duo is a TCP/IP network stack designed specifically for deeply embedded real-time and IoT applications. An attacker can caus CVE-2023-483175.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vikas Vatsa Display Custom Post allows CVE-2023-483186.5Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This is