Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-23944

Nextcloud mail is an email app for the nextcloud home server platform. In versions prior to 2.2.2 user's passwords were stored in cleartext in the database during the duration of OAuth2 setup procedure. Any attacker or malicious user with access to the database would have access to these user passwords until the OAuth setup has been completed. It is recommended that the Nextcloud Mail app is upgraded to 2.2.2. There are no known workarounds for this issue.

Published

2023-02-06T20:15:15.187

Last Modified

2024-11-21T07:47:09.267

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 2.0 (LOW)

Weaknesses

Type: Primary
CWE-312

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	nextcloud	mail	< 2.2.2	Yes

References

https://github.com/nextcloud/mail/pull/7797 Patch ([email protected])
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g86r-x755-93f4 Vendor Advisory ([email protected])
https://hackerone.com/reports/1806275 Permissions Required, Third Party Advisory ([email protected])
https://github.com/nextcloud/mail/pull/7797 Patch (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-g86r-x755-93f4 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://hackerone.com/reports/1806275 Permissions Required, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)