Skip to content
OpenAdvisories
Low · 3.5 Public exploit CVE-2022-4556 EUVD-2022-51891GHSA-vxr5-ghr8-4787

Alinto SOGo Identity SOGoUserDefaults.m _migrateMailIdentities cross site scripting

Published Dec 16, 2022 · Updated Apr 15, 2025 · Assigned by VulDB

Vendor: Alinto Product: SOGo Package: sogo Package: sogo Ecosystem: Debian Ecosystem: Ubuntu

Description

A vulnerability was found in Alinto SOGo up to 5.7.1 and classified as problematic. Affected by this issue is the function _migrateMailIdentities of the file SoObjects/SOGo/SOGoUserDefaults.m of the component Identity Handler. The manipulation of the argument fullName leads to cross site scripting. The attack may be launched remotely. Upgrading to version 5.8.0 is able to address this issue. The name of the patch is efac49ae91a4a325df9931e78e543f707a0f8e5e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215960.

Affected products

VendorProductAffectedFixed
Alinto SOGo 5.7.0, 5.7.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 13 sogo 5.8.0-1 —
Debian 12 sogo 5.8.0-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS sogo No fix yet —
Ubuntu Pro 20.04 LTS sogo No fix yet —
Ubuntu Pro 18.04 LTS sogo No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 16.04 LTS sogo No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • AshkanRafiee/CVE-2022-4556 ★ 1 · Aug 5, 2025

    📄Official disclosure of CVE-2022-4556 — Stored Cross-Site Scripting (XSS) vulnerability in SOGo Webmail v5.7.1, discovered by Ashkan Rafiee and Mostafa Abbasi. Includes full writeup and reproduction …

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References