CVE-2022-39258: mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI
mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
mailcow-dockerizedto a version that resolves this vulnerability.Patch 2022-09 mailcow Mootember Update
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39258?
The severity of CVE-2022-39258 is high with a CVSS score of 8.2.
How does CVE-2022-39258 affect mailcow?
CVE-2022-39258 affects mailcow versions prior to 2022-09.
What is the vulnerability in mailcow?
The vulnerability in mailcow allows an attacker to craft a custom Swagger API template to spoof Authorize links.
How can an attacker exploit CVE-2022-39258?
An attacker can exploit CVE-2022-39258 by redirecting a victim to an attacker-controlled place to steal Swagger authorization credentials or create a phishing page to steal information.
Are there any fixes available for CVE-2022-39258?
Yes, fixes for CVE-2022-39258 are available in versions from 2022-09 onwards of mailcow.