{"cve":"CVE-2023-23943","nvd":{"published":"2023-02-06T21:15:09.810","modified":"2026-06-17T05:38:20.533","status":"Modified","description":"Nextcloud mail is an email app for the nextcloud home server platform. In affected versions the SMTP, IMAP and Sieve host fields allowed to scan for internal services and servers reachable from within the local network of the Nextcloud Server. It is recommended that the Nextcloud Maill app is upgraded to 1.15.0 or 2.2.2. The only known workaround for this issue is to completely disable the nextcloud mail app.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":4.3},"cwes":["CWE-918"],"references":["https://github.com/nextcloud/mail/pull/7796","https://github.com/nextcloud/security-advisories/security/advisories/GHSA-8gcx-r739-9pf6","https://hackerone.com/reports/1736390","https://hackerone.com/reports/1741525","https://hackerone.com/reports/1746582"],"products":["nextcloud:mail"],"source":"nvd","synced_at":"2026-10-19T21:37:38.595364862+00:00"},"epss":{"cve":"CVE-2023-23943","score":0.00919,"percentile":0.60267,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}