CVE-2023-33184

{"id": "CVE-2023-33184", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.5, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.1}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2023-05-27T05:15:09.980", "references": [{"url": "https://github.com/nextcloud/mail/pull/8275", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9895-w564", "tags": ["Vendor Advisory"], "source": "[email protected]"}, {"url": "https://hackerone.com/reports/1913095", "tags": ["Issue Tracking"], "source": "[email protected]"}, {"url": "https://github.com/nextcloud/mail/pull/8275", "tags": ["Patch"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9895-w564", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://hackerone.com/reports/1913095", "tags": ["Issue Tracking"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-918"}]}, {"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3.\n\n"}], "lastModified": "2024-11-21T08:05:04.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10ED288F-DD07-4B60-AE0F-786BF82F4ADB", "versionEndExcluding": "1.15.3", "versionStartIncluding": "1.13.0"}, {"criteria": "cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A87F4309-C10F-41AC-B5BB-0DC0585AB5E1", "versionEndExcluding": "2.2.5", "versionStartIncluding": "2.2.0"}, {"criteria": "cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C30FC59F-1EEF-452F-B2E0-3E2B22F2CB02", "versionEndExcluding": "3.0.2", "versionStartIncluding": "2.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}