CVE-2023-33184

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-33184
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-33184.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-33184
Aliases
  • GHSA-8gph-9895-w564
Published
2023-05-27T04:36:01Z
Modified
2026-08-12T03:51:19Z
Severity
  • 3.5 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Blind SSRF in the Nextcloud Mail app on avatar endpoint
Details

Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-918"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33184.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "3.02"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/nextcloud/mail

Affected ranges

Type
GIT
Repo
https://github.com/nextcloud/mail
Events
Introduced
b303777415ae004ac6fb1508897fea290eafb9c7
Fixed
d33b5dc53cc9497f7d0e5a928e8f69b65ebc14f0
Introduced
e57d2891a69ec6851cc4e3782c0a9f7e0eb52c80
Fixed
c2fa1ff2f8a7d571f924311cf8bbefe00227b84f
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
829397a75f76a1d4ffec7bc20abeb0bb389dad8d
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.13.0"
        },
        {
            "fixed": "1.15.3"
        },
        {
            "introduced": "2.2.0"
        },
        {
            "fixed": "2.2.5"
        },
        {
            "introduced": "2.3.0"
        },
        {
            "fixed": "3.0.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

1.*
1.10.0-alpha.7
1.6.2
Other
nighly-20170831
nightly-20161202
nightly-20161208
nightly-20161218
nightly-20170117
nightly-20170612
nightly-20170823
nightly-20170831
nightly-20170906
nightly-20170913
nightly-20171127
nightly-20171212
nightly-20180410
nightly-20200115
nightly-20200423
nightly-20200427
nightly-20200506
nightly-20200513
untagged-bd8a3cab1eb0022ec683
v0.*
v0.1.0
v0.1.3
v0.10.0
v0.11.0
v0.12.0
v0.12.0-RC2
v0.12.0-RC3
v0.12.0-alpha3
v0.12.0-beta1
v0.12.0-beta2
v0.12.0-beta4
v0.12.0-beta5
v0.13.0
v0.14.0
v0.15.0
v0.15.1
v0.15.2
v0.15.3
v0.15.4
v0.15.5
v0.16.0
v0.17.0
v0.18.0
v0.18.0-RC1
v0.18.1
v0.19.0
v0.19.1
v0.2.0
v0.20.0
v0.20.1
v0.20.2
v0.20.3
v0.21.0
v0.21.1
v0.3.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v0.5.1
v0.5.2
v0.6.2
v0.7.0
v0.7.1
v0.7.10
v0.7.2
v0.7.3
v0.7.4
v0.7.5
v0.7.6
v0.7.7
v0.7.8
v0.7.9
v0.8.0
v0.8.0-alpha1
v0.8.0-beta1
v0.8.1
v0.8.2
v0.8.3
v0.9.0
v1.*
v1.0.0
v1.1.0
v1.1.1
v1.1.2
v1.10.0-RC.1
v1.10.0-alpha.4
v1.10.0-alpha.6
v1.10.0-alpha.7
v1.11.0
v1.11.0-rc1
v1.12.0-rc.1
v1.13.0-beta1
v1.13.0-beta3
v1.14.0
v1.14.0-alpha4
v1.14.0-beta1
v1.14.0-beta2
v1.14.0-beta3
v1.14.0-rc.1
v1.14.0-rc.2
v1.14.1
v1.14.2
v1.14.3
v1.14.3.alpha.1
v1.14.4
v1.14.5
v1.15.0
v1.15.1
v1.15.2
v1.3.0
v1.3.0-RC1
v1.3.0-beta1
v1.3.0-beta2
v1.3.0-beta3
v1.3.1
v1.3.2
v1.3.3
v1.4.0-beta1
v1.4.0-beta2
v1.4.0-rc1
v1.5.0
v1.5.0-alpha3
v1.5.0-beta1
v1.5.0-beta2
v1.5.0-beta3
v1.5.0-rc1
v1.5.0-rc2
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v1.9.0-alpha2
v1.9.0-alpha3
v2.*
v2.0.0-RC1
v2.0.0-beta.5
v2.0.0-beta.6
v2.0.0-beta.7
v2.0.0-beta1
v2.0.0-beta3
v2.0.0-beta4
v2.1.0-rc1
v2.2.0
v2.2.1
v2.2.2
v2.2.3
v2.2.4
v2.3.0-alpha.4
v3.*
v3.0.0
v3.0.0-alpha.1
v3.0.0-beta.2
v3.0.0-rc.1
v3.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-33184.json"