What’s Vulnerable › Vulnerabilities

CVE-2023-33184: Blind SSRF in the Nextcloud Mail app on avatar endpoint

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-05-27 · updated 2026-06-17
• Weakness: CWE-918

Description

Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3.

Affected products

• nextcloud Mail: from 1.13.0 before 1.15.3; from 2.2.0 before 2.2.5; from 2.3.0 before 3.0.2 — fixed in 1.15.3, 2.2.5, 3.0.2

How to fix

Upgrade to a fixed version: nextcloud Mail 1.15.3, 2.2.5, 3.0.2. Check the vendor advisory for mitigations.

References

• https://github.com/nextcloud/mail/pull/8275
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9895-w564
• https://hackerone.com/reports/1913095
• https://github.com/nextcloud/mail/pull/8275
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9895-w564
• https://hackerone.com/reports/1913095

Get alerted when CVE-2023-33184 or the next vulnerability affects your stack