Every CVE Search/ Get API key

CVE-2022-4556

Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting

3.5 LowPublic exploitFix available

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.61%Down 0.3 points since Dec 17, 2022
90%50%10%1%

What each source reports

CVE List Score used 3.5

Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.

Record
CVE-2022-4556
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-707
Updated
2026-11-02
EUVDEUVD-2022-51891 3.5

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.

Record
EUVD-2022-51891
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-vxr5-ghr8-4787 6.1

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by...

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.

Record
GHSA-vxr5-ghr8-4787
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
NVD 3.5

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.

Record
CVE-2022-4556
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-707
Updated
2026-11-02
OSV 3.5

Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.

Record
CVE-2022-4556
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness
CWE-707
Updated
2026-11-02
OSVDEBIAN-CVE-2022-4556 6.1

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.

Record
DEBIAN-CVE-2022-4556
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
OSVUBUNTU-CVE-2022-4556 3.5

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.

Record
UBUNTU-CVE-2022-4556
CVSS 3.1
3.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
sogo
Debian:12
 before 5.8.0-1
5.8.0-1
sogo
Debian:13
 before 5.8.0-1
5.8.0-1
sogo
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2.2.17a-12.2.17a-1.12.2.17a-1.1build12.2.17a-1.1ubuntu0.1~esm1
 None known
sogo
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.2.10-13.2.10-1build13.2.10-1ubuntu0.1~esm1
 None known
sogo
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
4.0.8-14.1.0-14.1.1-14.3.0-14.3.0-1ubuntu0.1~esm1
 None known
sogo
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
5.1.0-15.2.0-15.2.0-35.3.0-15.3.0-1build2
Show 4 moreShow less
5.4.0-15.5.0-15.5.1-15.5.1-1ubuntu0.1~esm1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubAshkanRafiee/CVE-2022-45562025-08-05

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-4556 is a low vulnerability (CVSS 3.5) in Alinto Sogo, published December 16, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.61%, the 49th percentile. Fixed in sogo 5.8.0-1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open