Medium severity4.3NVD Advisory· Published Oct 16, 2023· Updated Jun 17, 2026

CVE-2023-45660

Description

Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nextcloud/Mail
cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*
Range: >=2.2.0,<2.2.8
Nextcloud/Nextcloudllm-fuzzy
Range: before 2.2.8 and 3.3.0
Nextcloud/security-advisoriescpe-rescue
Range: >= 2.0.0, < 2.2.8

Patches

Vulnerability mechanics

References

github.com/nextcloud/mail/pull/8459nvdIssue TrackingPatch
github.com/nextcloud/security-advisories/security/advisories/GHSA-8j9x-fmww-qr37nvdVendor Advisory
hackerone.com/reports/1895874nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000