/Vulnerability Library

Mailcow Dockerized Swagger UI - Cross-Site Scripting

CVE-2022-39258
Verified

Description

Mailcow-dockerized before 2022-09a uses a vulnerable version of Swagger UI (before 4.11.1) that is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. When a user accesses the Swagger documentation with a crafted configUrl or url parameter containing JavaScript payloads, arbitrary code execution can occur in the user's browser. This allows attackers to steal cookies, session data, or execute actions on behalf of the victim by enticing them to open a malicious Swagger UI link.

Severity

Medium

CVSS Score

6.1

Exploit Probability

2%

Affected Product

mailcow-dockerized

Published Date

June 11, 2026

Template Author

ritikchaddha

CVE-2022-39258.yaml
6.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2022-39258
CWE ID:
cwe-79

References

https://github.com/mailcow/mailcow-dockerized/security/advisories/GHSA-99r2-q6fj-6w47https://github.com/swagger-api/swagger-ui/issues/8322https://nvd.nist.gov/vuln/detail/CVE-2022-39258

Remediation Steps

Upgrade mailcow-dockerized to at least 2022-09a, which updates Swagger UI to version 4.11.1 or later. Do not expose internal Swagger UI endpoints publicly.