Vulnerability Description
mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, delete2foldersonly, delete2foldersbutnot, regextrans2, pipemess, or maxlinelengthcmd to execute arbitrary code. Users should update their mailcow instances with the `update.sh` script in the mailcow root directory to 2022-06a or newer to receive a patch for this issue. As a temporary workaround, the Syncjob ACL can be removed from all mailbox users, preventing changes to those settings.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mailcow | Mailcow\ | < 2022-06a, _dockerized |
Related Weaknesses (CWE)
References
- https://github.com/ly1g3/Mailcow-CVE-2022-31138ExploitThird Party Advisory
- https://github.com/mailcow/mailcow-dockerized/commit/d373164e13a14e058f82c9f1918PatchThird Party Advisory
- https://github.com/mailcow/mailcow-dockerized/releases/tag/2022-06aRelease NotesThird Party Advisory
- https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-vx9w-h33pMitigationThird Party Advisory
- https://github.com/ly1g3/Mailcow-CVE-2022-31138ExploitThird Party Advisory
- https://github.com/mailcow/mailcow-dockerized/commit/d373164e13a14e058f82c9f1918PatchThird Party Advisory
- https://github.com/mailcow/mailcow-dockerized/releases/tag/2022-06aRelease NotesThird Party Advisory
- https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-vx9w-h33pMitigationThird Party Advisory
FAQ
What is CVE-2022-31138?
CVE-2022-31138 is a vulnerability with a CVSS score of 8.8 (HIGH). mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom parameters regexmess, skipmess, regexflag, ...
How severe is CVE-2022-31138?
CVE-2022-31138 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-31138?
Check the references section above for vendor advisories and patch information. Affected products include: Mailcow Mailcow\.