CVE-2022-39258

mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server.

• CWE-200
• CWE-451
• CWE-601

• https://github.com/mailcow/mailcow-dockerized/pull/4766Patch, Third Party Advisory
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-vjgf-cp5p-wm45Exploit, Third Party Advisory
• https://github.com/mailcow/mailcow-dockerized/pull/4766Patch, Third Party Advisory
• https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-vjgf-cp5p-wm45Exploit, Third Party Advisory

Published

Sep 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39252matrix-rust-sdk is an implementation of a Matrix client-serv…7.5
• CVE-2022-39253Git is an open source, scalable, distributed revision contro…5.5
• CVE-2022-39254matrix-nio is a Python Matrix client library, designed accor…6.5
• CVE-2022-39255Matrix iOS SDK allows developers to build iOS apps compatibl…7.5
• CVE-2022-39256Orckestra C1 CMS is a .NET based Web Content Management Syst…8
• CVE-2022-39257Matrix iOS SDK allows developers to build iOS apps compatibl…7.5
• CVE-2022-39259jadx is a set of command line and GUI tools for producing Ja…5.5
• CVE-2022-3926The WP OAuth Server (OAuth Authentication) WordPress plugin …6.5
• CVE-2022-39260Git is an open source, scalable, distributed revision contro…8.8
• CVE-2022-39261Twig is a template language for PHP. Versions 1.x prior to 1…7.5
• CVE-2022-39262GLPI stands for Gestionnaire Libre de Parc Informatique. GLP…4.8
• CVE-2022-39263`@next-auth/upstash-redis-adapter` is the Upstash Redis adap…8.1