Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
nvd[email protected]NVD:CVE-2022-31132
HistoryAug 04, 2022 - 5:15 p.m.

CVE-2022-31132

2022-08-0417:15:08
CWE-918
[email protected]
web.nvd.nist.gov
7
nextcloud mail
email application
css minifier
unrestricted access
server-side request forgery
ssrf
upgrade
vulnerability
deletion
file.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

58.3%

JSON

Nextcloud Mail is an email application for the nextcloud personal cloud product. Affected versions shipped with a CSS minifier on the path ./vendor/cerdic/css-tidy/css_optimiser.php. Access to the minifier is unrestricted and access may lead to Server-Side Request Forgery (SSRF). It is recommendet to upgrade to Mail 1.12.7 or Mail 1.13.6. Users unable to upgrade may manually delete the file located at ./vendor/cerdic/css-tidy/css_optimiser.php

Affected configurations

Nvd
Node
nextcloudmailRange<1.12.8
OR
nextcloudmailRange1.13.0–1.13.6
VendorProductVersionCPE
nextcloudmail*cpe:2.3:a:nextcloud:mail:*:*:*:*:*:*:*:*

Related

nextcloud 1
osv 1
cvelist 1
prion 1
hackerone 1
cve 1
nextcloud
nextcloud
Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
2022-08-04 06:29:01
osv
osv
CVE-2022-31132
2022-08-04 17:15:08
cvelist
cvelist
CVE-2022-31132 Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
2022-08-04 17:10:10
prion
prion
Server side request forgery (ssrf)
2022-08-04 17:15:00
hackerone
hackerone
Nextcloud: Unauthenticated SSRF in 3rd party module "cerdic/csstidy"
2022-06-08 14:50:19
cve
cve
CVE-2022-31132
2022-08-04 17:15:08

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

58.3%

JSON
Related for NVD:CVE-2022-31132
nextcloud1osv1cvelist1prion1hackerone1cve1