CVE-2022-28218

An issue was discovered in CipherMail Webmail Messenger 1.1.1 through 4.1.4. A local attacker could access secret keys (found in a Roundcube configuration file) that are used to protect Webmail user passwords and two-factor authentication (2FA).

Score

CVSS 3.1 5.5 Medium

Status

Modified - cve@mitre.org

Published

2022-04-26

Last modified

2024-08-03

Weaknesses

CWE-276

Affected products

• Webmail Messenger (Ciphermail)

References

• https://ciphermail.com
• https://lists.ciphermail.com/hyperkitty/list/security%40lists.ciphermail.com/thread/WRWHQUACXWXQA42KXXQQ6EEP6SBBM5BM/
• https://www.ciphermail.com/webmail-release-notes.html