Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css-tidy/css_optimiser.php`. Access to the minifier is unrestricted and access may lead to Server-Side Request Forgery (SSRF). It is recommendet to upgrade to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at `./vendor/cerdic/css-tidy/css_optimiser.php`
References
Link | Resource |
---|---|
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24pm-rjfv-23mh | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
10 Aug 2022, 15:35
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:* | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
First Time |
Nextcloud
Nextcloud mail |
|
References | (CONFIRM) https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24pm-rjfv-23mh - Third Party Advisory |
04 Aug 2022, 17:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2022-08-04 17:15
Updated : 2023-12-10 14:35
NVD link : CVE-2022-31132
Mitre link : CVE-2022-31132
CVE.ORG link : CVE-2022-31132
JSON object : View
Products Affected
nextcloud
CWE
CWE-918
Server-Side Request Forgery (SSRF)