GCVE - cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Nextcloud (`e5ae4298-6932-564f-a40d-08cebea039a5`)
Product	Mail (`b095abef-4c07-51bc-8bc5-b5cef59cfad6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/nextcloud/mail`	purl2cpe	2026-06-01 10:17:58.778160

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-48307`	vulnerable	2026-06-08 06:14:26.847714	Nextcloud Mail app vulnerable to Server-Side Request Forgery LOW (3.5) Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker can use an unprotected endpoint in the Mail app to perform a SSRF attack. Nextcloud Mail app versions 2.2.8 and 3.3.0 contain a patch for this issue. As a workaround, disable the mail app. Published: 2023-11-21T22:22:56.780Z Updated: 2024-08-02T21:23:39.494Z Open on db.gcve.eu Reference links https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4pp4-m8ph-2999 https://github.com/nextcloud/mail/pull/8709 https://hackerone.com/reports/1869714	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-45660`	vulnerable	2026-06-08 06:12:43.072199	Require strict cookies for image proxy requests in Nextcloud Mail MEDIUM (4.3) Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability. Published: 2023-10-16T18:32:00.486Z Updated: 2024-09-13T19:36:36.050Z Open on db.gcve.eu Reference links https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8j9x-fmww-qr37 https://github.com/nextcloud/mail/pull/8459 https://hackerone.com/reports/1895874	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-33184`	vulnerable	2026-06-08 06:06:21.938934	Blind SSRF in the Nextcloud Mail app on avatar endpoint LOW (3.5) Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It is recommended that the Mail app is update to version 3.02, 2.2.5 or 1.15.3. Published: 2023-05-27T04:36:01.535Z Updated: 2025-01-14T18:17:48.760Z Open on db.gcve.eu Reference links https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gph-9895-w564 https://github.com/nextcloud/mail/pull/8275 https://hackerone.com/reports/1913095	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-25160`	vulnerable	2026-06-08 05:56:08.607891	IDOR Vulnerability in Nextcloud Mail MEDIUM (4.1) Nextcloud Mail is an email app for the Nextcloud home server platform. Prior to versions 2.2.1, 1.14.5, 1.12.9, and 1.11.8, an attacker can access the mail box by ID getting the subjects and the first characters of the emails. Users should upgrade to Mail 2.2.1 for Nextcloud 25, Mail 1.14.5 for Nextcloud 22-24, Mail 1.12.9 for Nextcloud 21, or Mail 1.11.8 for Nextcloud 20 to receive a patch. No known workarounds are available. Published: 2023-02-13T20:19:08.774Z Updated: 2025-03-10T21:12:50.353Z Open on db.gcve.eu Reference links https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m45f-r5gh-h6cx https://github.com/nextcloud/mail/pull/7740 https://hackerone.com/reports/1784681	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23944`	vulnerable	2026-06-08 05:56:04.877886	Nexcloud Mail app temporarily stores cleartext password in database LOW (2) Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed. It is recommended that the Nextcloud Mail app is upgraded to 2.2.2. There are no known workarounds for this issue. Published: 2023-02-06T19:35:31.498Z Updated: 2025-03-10T21:16:09.420Z Open on db.gcve.eu Reference links https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g86r-x755-93f4 https://github.com/nextcloud/mail/pull/7797 https://hackerone.com/reports/1806275	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-23943`	vulnerable	2026-06-08 05:56:04.877407	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-31132`	vulnerable	2026-06-08 05:43:40.259926	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-31119`	vulnerable	2026-06-08 05:43:40.237486	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-39220`	vulnerable	2026-06-08 05:33:49.217366	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-32707`	vulnerable	2026-06-08 05:32:07.882114	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-32652`	vulnerable	2026-06-08 05:32:07.777828	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-8156`	vulnerable	2026-06-08 05:27:14.976621	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.