ashkanrafiee/cve-2022-4556📄Official disclosure of CVE-2022-4556 — Stored Cross-Site Scripting (XSS) vulnerability in SOGo Webmail v5.7.1, discovered by Ashkan Rafiee and Mostafa Abbasi. Includes full writeup and reproduction steps.
A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the fullName field of the Identity Preferences section in the SOGo web interface, affecting version 5.7.1. An authenticated attacker could inject a malicious script that would execute whenever any user (including the attacker) accessed the Mail tab.
Preferences → Mail → IMAP Accounts → Edit Identity
</script><svg onload=alert(1)>
The application fails to properly sanitize user input in the fullName field before reflecting it into HTML content, allowing stored JavaScript payloads to persist across sessions and users.
Sanitize all user-controlled input before rendering it into the DOM. In this case, ensure the fullName field is properly escaped or filtered on both input and output.
🛠 Refer to the OWASP Cheat Sheet:
This writeup and documentation are licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).