CVE-2022-39258

mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI

mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server.

Affected

mailcow · mailcow-dockerized

CVSS v3.1 NVD

8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

CVSS v3.1 GITHUB

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

1.83% chance of exploitation in the next 30 days, 79th percentile

Nuclei

medium · CWE-79

Published

2022-09-27

Updated

2025-04-22

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-39258.yaml

Security advisories

• mailcow/mailcow-dockerized/pull/4766
• mailcow/mailcow-dockerized/security/advisories/GHSA-vjgf-cp5p-wm45

References

• CVE Record
• NVD entry