CVE-2023-23943: nextcloud mail Server-Side Request Forgery (SSRF)
Vulnerability summary
CVE-2023-23943 is a medium (CVSS 5.0) Server-Side Request Forgery (SSRF) vulnerability in nextcloud mail. EPSS estimates a 0.92% chance of exploitation in the next 30 days, higher than 59.5% of scored vulnerabilities. 3 public exploits are recorded.
Timeline
- 06-02-2023PublishedVulnerability first disclosed.
- 10-03-2025Last modifiedVulnerability information updated.
Description
Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.92%
Chance of exploitation in the next 30 days
Percentile
60%
Versus all other CVEs
30-day change
0.00 pp
From 0.92% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
3 foundExploit Reference (hackerone.com)
Maturity: unknown
Exploit Reference (hackerone.com)
Maturity: unknown
Exploit Reference (hackerone.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Nextcloud2 products
- mail< 1.15.0 | ≥ 2.2.0, < 2.2.2
- security-advisories≥ 2.0.0, < 2.2.2 | < 1.15.0
1 vendor · 2 products
References
5 links- github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r739-9pf6X Refsource CONFIRMVendor Advisory