CVE-2022-4556 — Improper Neutralization in Sogo

CWE-707 — Improper NeutralizationCWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
CNA3.5
EPSS
0.2%
top 62.18%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Alinto Sogo
Timeline
PublishedDec 16
Latest updateDec 22

Description

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affec…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDalinto/sogo< 5.8.0
▶Debianalinto/sogo< 5.8.0-1+2
▶CVEListV5alinto/sogo5.7.0, 5.7.1+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-vxr5-ghr8-4787: A vulnerability was found in Alinto SOGo up to 5↗2022-12-22
▶
OSV
CVE-2022-4556: A vulnerability was found in Alinto SOGo up to 5↗2022-12-16
▶
CVEList
Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting↗2022-12-16
▶

📋Vendor Advisories

1
Debian
CVE-2022-4556: sogo - A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problemat...↗2022
▶
CVE-2022-4556 — Improper Neutralization in Alinto Sogo | cvebase