CVE-2022-31245
High
Description
mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.
SeverityHigh
CVSS8.8
Exploit probability—
ProductMailcow\
PublishedMay 20, 2022
First seenMay 20, 2022
How to fix
Update
- mailcow mailcow\2022-05d or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mailcow mailcow\ | _dockerized ≤ v < 2022-05d | 2022-05d |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.