CVE-2022-31245

mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C

EPSS

5.44% chance of exploitation in the next 30 days, 92th percentile

Published

2022-05-20

Updated

2024-08-03

Proof-of-concept exploits (1)

• ly1g3/Mailcow-CVE-2022-3124512★ · 2022-07-25

References

• CVE Record
• NVD entry

Related

• CVE-2022-31138
• CVE-2022-35131
• CVE-2022-35132
• CVE-2022-36880
• CVE-2022-46332
• CVE-2022-46333