CVE-2024-56529: High severity mailcow vulnerability
Mailcow through 2024-11b has a session fixation vulnerability in the web panel. It allows remote attackers to set a session identifier when HSTS is disabled on a victim's browser. After a user logs in, they are authenticated and the session identifier is valid. Then, a remote attacker can access the victim's web panel with the same session identifier.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56529?
CVE-2024-56529 is classified as a high severity vulnerability due to its potential for remote exploitation.
How do I fix CVE-2024-56529?
To fix CVE-2024-56529, upgrade Mailcow to a version later than 2024-11b where the vulnerability has been addressed.
Who is affected by CVE-2024-56529?
CVE-2024-56529 affects users of Mailcow versions up to and including 2024-11b who have HSTS disabled in their browsers.
What is the impact of CVE-2024-56529?
The impact of CVE-2024-56529 allows remote attackers to hijack user sessions if they can set a session identifier.
Is there a workaround for CVE-2024-56529?
A temporary workaround for CVE-2024-56529 is to enable HSTS in user browsers until an upgrade can be performed.