CVE-2023-25160

Опубликовано: 13 фев. 2023

Источник: nvd

CVSS3: 4.1

CVSS3: 5.3

EPSS Низкий

Описание

Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for Nextcloud 22-24, Mail 1.12.9 for Nextcloud 21, or Mail 1.11.8 for Nextcloud 20 to receive a patch. No known workarounds are available.

Ссылки

https://github.com/nextcloud/mail/pull/7740
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m45f-r5gh-h6cx
Vendor Advisory
https://hackerone.com/reports/1784681
Permissions Required
Third Party Advisory
https://github.com/nextcloud/mail/pull/7740
Patch
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m45f-r5gh-h6cx
Vendor Advisory
https://hackerone.com/reports/1784681
Permissions Required
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*

Версия до 1.11.8 (исключая)

cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*

Версия от 1.12.0 (включая) до 1.12.9 (исключая)

cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*

Версия от 1.13.0 (включая) до 1.14.5 (исключая)

cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*

Версия от 2.0.0 (включая) до 2.2.1 (исключая)

EPSS

Процентиль: 56%

0.0034

Низкий

4.1 Medium

CVSS3

5.3 Medium

CVSS3

Дефекты

CWE-639

EPSS

Процентиль: 56%

0.0034

Низкий

4.1 Medium

CVSS3

5.3 Medium

CVSS3

Дефекты

CWE-639