{"id":"CVE-2023-45660","aliases":["EUVD-2023-49951","GHSA-8j9x-fmww-qr37"],"status":"published","title":"Require strict cookies for image proxy requests in Nextcloud Mail","description":"Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00759,"percentile":0.55735,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2023-10-16T18:32:00Z","modified":"2026-10-28T02:30:56Z","products":[{"vendor":"kiteworks","product":"security-advisories"},{"vendor":"nextcloud","product":"mail"},{"vendor":"nextcloud","product":"security-advisories"}],"references":[{"url":"https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8j9x-fmww-qr37","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/nextcloud/mail/pull/8459","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","fix"]},{"url":"https://hackerone.com/reports/1895874","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45660.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45660","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-45660","title":"Require strict cookies for image proxy requests in Nextcloud Mail","description":"Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.","status":"published","published":"2023-10-16T18:32:00.486Z","modified":"2024-09-13T19:36:36.05Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:35:22.984825Z"}],"euvd":[{"id":"EUVD-2023-49951","description":"Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.","status":"published","published":"2023-10-16T18:32:00Z","modified":"2024-09-13T19:36:36Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:55.02611Z"}],"nvd":[{"id":"CVE-2023-45660","description":"Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.","status":"published","published":"2023-10-16T19:15:11.06Z","modified":"2026-06-17T06:29:02.89Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:08:37.83429Z"}],"osv":[{"id":"CVE-2023-45660","title":"Require strict cookies for image proxy requests in Nextcloud Mail","description":"Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcloud Mail is upgraded to 2.2.8 or 3.3.0. There are no known workarounds for this vulnerability.","status":"published","published":"2023-10-16T18:32:00.486Z","modified":"2026-10-28T02:30:56.013214577Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:44:34.287121Z"}]}}