CVE-2022-4558: alinto sogo

csirt@kutim:~/threat-intel/cve/CVE-2022-4558

CVSS 6.1 · Medium EPSS 0,59%

Kerentanan Improper Neutralization pada alinto sogo. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

A vulnerability was found in Alinto SOGo up to 5.7.1. It has been classified as problematic. This affects an unknown part of the file SoObjects/SOGo/NSString+Utilities.m of the component Folder/Mail Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is 1e0f5f00890f751e84d67be4f139dd7f00faa5f3. It is recommended to upgrade the affected component. The identifier VDB-215961 was assigned to this vulnerability.

Rincian

Terbit di NVD: 16 Desember 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-707: Improper Neutralization
EPSS (30 hari): 0,59% peluang dieksploitasi; lebih tinggi dari 46,7% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
alinto	sogo	Semua versi sebelum 5.8.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Alinto/sogo/commit/1e0f5f00890f751e84d67be4f139dd7f00faa5f3 patch · advisory pihak ketiga
https://github.com/Alinto/sogo/releases/tag/SOGo-5.8.0 release notes · advisory pihak ketiga
https://vuldb.com/?id.215961 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.