CVE-2022-31132

· HIGHModified

← All CVEs

CVSS v3.1

8.3

EPSS

0.68%

Published

Aug 4, 2022

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path `./vendor/cerdic/css-tidy/css_optimiser.php`. Access to the minifier is unrestricted and access may lead to Server-Side Request Forgery (SSRF). It is recommendet to upgrade to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at `./vendor/cerdic/css-tidy/css_optimiser.php`

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Weaknesses (CWE)

CWE-918

Affected Products (2)

nextcloud · mail (up to 1.12.8)vulnerable

nextcloud · mail (up to 1.13.6)vulnerable

References (2)

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24pm-rjfv-23mh

Third Party Advisory

https://github.com/nextcloud/security-advisories/security/advisories/GHSA-24pm-rjfv-23mh

Third Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs