CVE-2022-31245: OS Command Injection
mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-31245?
CVE-2022-31245 is a vulnerability in mailcow before 2022-05d that allows a remote authenticated user to inject OS commands and escalate privileges to domain admin.
How severe is CVE-2022-31245?
CVE-2022-31245 has a severity rating of 8.8, which is classified as critical.
What is affected by CVE-2022-31245?
The affected software is mailcow before version 2022-05d.
How can a remote authenticated user exploit CVE-2022-31245?
A remote authenticated user can exploit CVE-2022-31245 by using the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.
Are there any references for CVE-2022-31245?
Yes, you can find references for CVE-2022-31245 at the following links: - [GitHub Advisory](https://github.com/ly1g3/Mailcow-CVE-2022-31245) - [Mailcow Dockerized Releases](https://github.com/mailcow/mailcow-dockerized/releases/tag/2022-05d)