PT-2023-19946

CVE-2023-25160

Published

2023-02-13

Updated

2023-02-22

Description by

CVSS 3.1

4.1

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nextcloud Mail versions prior to 2.2.1 Nextcloud Mail versions prior to 1.14.5 Nextcloud Mail versions prior to 1.12.9 Nextcloud Mail versions prior to 1.11.8

Description Nextcloud Mail is an email app for the Nextcloud home server platform. An attacker can access the mail box by ID, getting the subjects and the first characters of the emails.

Recommendations For Nextcloud 25, upgrade to Mail 2.2.1 to receive a patch. For Nextcloud 22-24, upgrade to Mail 1.14.5 to receive a patch. For Nextcloud 21, upgrade to Mail 1.12.9 to receive a patch. For Nextcloud 20, upgrade to Mail 1.11.8 to receive a patch.

Exploitability

Exploit

Fix

Impacts

Researchers

Ctulhu

Vendors

Affected products

Weakness enumeration

CWE-639: Authorization Bypass Through User-Controlled Key

Related identifiers

CVE-2023-25160