Blind SSRF in the Nextcloud Mail app on avatar endpoint
Priority LOW 25CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00529 44th percentileScored 2026-11-07
Fix Fixed security-advisories (nextcloud): 1.15.3, 2.2.5, 3.02
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| nextcloud | security-advisories | before 1.15.3; before 2.2.5; before 3.02 | 1.15.3, 2.2.5, 3.02 | Patch available | CNA |
- security-advisories Vendornextcloud Affected before 1.15.3; before 2.2.5; before 3.02 Fixed in 1.15.3, 2.2.5, 3.02 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:* | 1.13.0 to before 1.15.3; 2.2.0 to before 2.2.5; 2.3.0 to before 3.0.2 | Vulnerable | nextcloud |
- cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:* Versions 1.13.0 to before 1.15.3; 2.2.0 to before 2.2.5; 2.3.0 to before 3.0.2 Vulnerable ·nextcloud
Remediation
- Fix · CNA security-advisories (nextcloud) Fixed in 1.15.3, 2.2.5, 3.02
Timeline
- 2026-10-02 Threatist record created from CVE-2023-33184
References
More nextcloud Mail vulnerabilities
- TI-2023-09741 Blind SSRF via server URL input in the Nextcloud Mail app CVSS 3.1MEDIUM 5.0
- TI-2022-13176 Unauthenticated SSRF in 3rd party module "cerdic/csstidy" CVSS 3.1CRITICAL 9.8
- TI-2023-26170 Nextcloud Mail app vulnerable to Server-Side Request Forgery CVSS 3.1CRITICAL 9.8
- TI-2021-12320 Missing permission check on email metadata retrieval CVSS 3.1HIGH 8.8
- TI-2024-35179 Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers CVSS 3.1HIGH 8.2
- TI-2020-06574 A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed a man in the middle attack. CVSS 3.1HIGH 7.0
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences