CVE-2022-31245

Name of the Vulnerable Software and Affected Versions mailcow versions prior to 2022-05d

Description The issue allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction with the ---PIPEMESS option in Sync Jobs.

Recommendations For versions prior to 2022-05d, update to a version 2022-05d or later to resolve the issue. As a temporary workaround, consider disabling the --debug option and the ---PIPEMESS option in Sync Jobs until a patch is available. Restrict access to Sync Jobs to minimize the risk of exploitation.