PT-2022-20551 · Nextcloud · Nextcloud Mail

Julien-Nc

+1

·

CVE-2022-31131

·

Published

2022-07-06

·

Updated

2023-06-29

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Nextcloud mail versions prior to 1.12.2
Description The issue concerns missing user account ownership checks when performing tasks related to mail attachments in Nextcloud mail, potentially exposing attachments to incorrect system users.
Recommendations For versions prior to 1.12.2, upgrade the Nextcloud Mail app to 1.12.2, as there are no known workarounds for this issue.

Exploit

Fix

Improper Authentication

IDOR

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-287CWE-639

Related Identifiers

CVE-2022-31131
GHSA-XHV7-5MHV-299J

Affected Products

Nextcloud Mail