CVE-2022-39258CWE-200CWE-451

mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI

High · published September 27, 2022

CVSS v3.1
8.1
EPSS
2%
Percentile
78.7
In the wild
Unconfirmed
What it is

mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01832 · 78.7th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-451 · User Interface (UI) Misrepresentation of Critical Information
Published
2022-09-27T15:10Z
EPSS history
Timeline
  • 27 SEP 15:10Z
    mailcow-dockerized critical information misrepresentation can lead to phishing attacks through Swagger UI
    cvelistv5