CVE-2022-39258

    Dashboard / Vulnerabilities / CVE-2022-39258

    CVE-2022-39258

    Published: 27 Sept 2022Last Modified: 21 Oct 2026

    Summary: mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI

    Details: mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/39xxx/CVE-2022-39258.json, https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-vjgf-cp5p-wm45, https://nvd.nist.gov/vuln/detail/CVE-2022-39258, https://github.com/mailcow/mailcow-dockerized/pull/4766

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -cb058e91a3f3109dd5812e44174f32f2a9020fc0

    Affected versions

    2022-09

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High