CVE-2022-39258

 

Published at: - 27-09-2022 05:15

Last modified: - 28-09-2022 01:15

Total changes: - 1

Description

mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server.

Common Vulnerability Scoring System (CVSS)

-

 

Verification logic

 

Reference

• https://github.com/mailcow/mailcow-dockerized/pull/4766
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-vjgf-cp5p-wm45

 

Keywords

NVD

 

CVE-2022-39258

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures