CVE-2022-31132

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-31132
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31132.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-31132
Aliases
  • GHSA-24pm-rjfv-23mh
Published
2022-08-04T17:10:10Z
Modified
2026-07-15T01:48:55.728006632Z
Severity
  • 8.3 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
Summary
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
Details

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path ./vendor/cerdic/css-tidy/css_optimiser.php. Access to the minifier is unrestricted and access may lead to Server-Side Request Forgery (SSRF). It is recommendet to upgrade to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at ./vendor/cerdic/css-tidy/css_optimiser.php

Database specific 
{
    "cna_assigner": "GitHub_M",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "1.12.8"
                },
                {
                    "introduced": "1.13.0"
                },
                {
                    "fixed": "1.13.6"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31132.json",
    "cwe_ids": [
        "CWE-918"
    ]
}
References

Affected packages

Git / github.com/nextcloud/mail

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/mail
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
eefa6f2d107976ee2d85e7e344ca7bec31c55421
Introduced
b303777415ae004ac6fb1508897fea290eafb9c7
Fixed
6e67f81596e4409872e378656d315bbda58d24ef
Database specific 
{
    "cpe": "cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.12.8"
        },
        {
            "introduced": "1.13.0"
        },
        {
            "fixed": "1.13.6"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

1.*
1.10.0-alpha.7
1.6.2
Other
nighly-20170831
nightly-20161202
nightly-20161208
nightly-20161218
nightly-20170117
nightly-20170612
nightly-20170823
nightly-20170831
nightly-20170906
nightly-20170913
nightly-20171127
nightly-20171212
nightly-20180410
nightly-20200115
nightly-20200423
nightly-20200427
nightly-20200506
nightly-20200513
untagged-bd8a3cab1eb0022ec683
v0.*
v0.1.0
v0.1.3
v0.10.0
v0.11.0
v0.12.0
v0.12.0-RC2
v0.12.0-RC3
v0.12.0-alpha3
v0.12.0-beta1
v0.12.0-beta2
v0.12.0-beta4
v0.12.0-beta5
v0.13.0
v0.14.0
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.15.4
v0.15.5
v0.16.0
v0.17.0
v0.18.0
v0.18.0-RC1
v0.18.1
v0.19.0
v0.19.1
v0.2.0
v0.20.0
v0.20.1
v0.20.2
v0.20.3
v0.21.0
v0.21.1
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v0.5.1
v0.5.2
v0.6.2
v0.7.0
v0.7.1
v0.7.10
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.0-alpha1
v0.8.0-beta1
v0.8.1
v0.8.2
v0.8.3
v0.9.0
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.10.0-RC.1
v1.10.0-alpha.4
v1.10.0-alpha.6
v1.10.0-alpha.7
v1.11.0
v1.11.0-rc1
v1.12.0
v1.12.0-rc.1
v1.12.0-rc.2
v1.12.0-rc3
v1.12.1
v1.12.1-rc.1
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.12.6-rc.1
v1.12.7
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.13.4
v1.13.4-rc.1
v1.13.5
v1.3.0
v1.3.0-RC1
v1.3.0-beta1
v1.3.0-beta2
v1.3.0-beta3
v1.3.1
v1.3.2
v1.3.3
v1.4.0-beta1
v1.4.0-beta2
v1.4.0-rc1
v1.5.0
v1.5.0-alpha3
v1.5.0-beta1
v1.5.0-beta2
v1.5.0-beta3
v1.5.0-rc1
v1.5.0-rc2
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v1.9.0-alpha2
v1.9.0-alpha3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-31132.json"