CVE-2023-23943

Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app.

• CWE-918

• https://github.com/nextcloud/mail/pull/7796Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r739-9pf6Vendor Advisory
• https://hackerone.com/reports/1736390Exploit, Third Party Advisory
• https://hackerone.com/reports/1741525Exploit, Third Party Advisory
• https://hackerone.com/reports/1746582Exploit, Third Party Advisory
• https://github.com/nextcloud/mail/pull/7796Patch
• https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r739-9pf6Vendor Advisory
• https://hackerone.com/reports/1736390Exploit, Third Party Advisory
• https://hackerone.com/reports/1741525Exploit, Third Party Advisory
• https://hackerone.com/reports/1746582Exploit, Third Party Advisory

Published

Feb 6, 2023

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-23938Tuleap is a Free & Source tool for end to end traceability o…4.8
• CVE-2023-23939Azure/setup-kubectl is a GitHub Action for installing Kubect…7
• CVE-2023-2394A vulnerability was found in Netgear SRX5308 up to 4.3.5-3. …4.8
• CVE-2023-23940OpenZeppelin Contracts for Cairo is a library for secure sma…5.3
• CVE-2023-23941SwagPayPal is a PayPal integration for shopware/platform. If…7.5
• CVE-2023-23942The Nextcloud Desktop Client is a tool to synchronize files …6.1
• CVE-2023-23944Nextcloud mail is an email app for the nextcloud home server…6.5
• CVE-2023-23946Git, a revision control system, is vulnerable to path traver…7.5
• CVE-2023-23947Argo CD is a declarative, GitOps continuous delivery tool fo…8.5
• CVE-2023-23948The ownCloud Android app allows ownCloud users to access, sh…5.5
• CVE-2023-23949An authenticated user can supply malicious HTML and JavaScri…5.4
• CVE-2023-2395A vulnerability classified as problematic has been found in …6.1