Security readout for executives and security teams
Plain-English summary
CVE-2022-50908 is a stored XSS issue in MailHog 1.0.1. A crafted email attachment can store script content that runs in the MailHog interface, potentially manipulating the browser or making MailHog API calls such as deleting messages. This matters most where MailHog is reachable by untrusted senders or exposed beyond a private development environment.
Executive priority
Prioritize remediation where MailHog is internet-exposed, shared across teams, or receives untrusted email. For isolated local development use, urgency is lower but still warrants access restriction and version review. Public exploit information raises operational risk even without confirmed active exploitation.
Technical view
MailHog 1.0.1 is reported vulnerable to CWE-79 stored cross-site scripting via email attachments. The CVSS 3.1 score is 7.2, network exploitable with low complexity and changed scope. Public exploit information exists, but the provided sources do not establish active exploitation. The described impact includes arbitrary API calls and browser manipulation from the MailHog context.
Likely exposure
Organizations using MailHog 1.0.1, especially with a reachable web interface or SMTP intake from untrusted sources, may be exposed. Shodan has a MailHog search reference, indicating internet-discoverable deployments are plausible, but the provided bundle does not quantify exposure.
Exploitation context
The vulnerability is documented by VulnCheck and an Exploit-DB entry is referenced, so public exploit information exists. CISA KEV status is false in the provided data, and no cited source confirms active exploitation. Risk increases if attackers can deliver emails into MailHog and reach the MailHog browser session or API context.
Researcher notes
Evidence supports MailHog 1.0.1 stored XSS via attachments with CVSS 7.2 and CWE-79. The source bundle names Exploit-DB and VulnCheck, but does not provide a vendor fix. Avoid assuming all MailHog versions are affected. Validate exposure through asset inventory, version checks, and access paths rather than broad product assumptions.
Mitigation direction
- Identify any MailHog 1.0.1 deployments in development, testing, and shared environments.
- Restrict MailHog web UI and SMTP access to trusted networks only.
- Do not expose MailHog directly to the internet unless vendor guidance supports it.
- Check the MailHog project and advisory sources for fixed versions or official guidance.
- Treat MailHog data as potentially unsafe if untrusted emails were processed.
Validation and detection
- Confirm installed MailHog version and compare against 1.0.1.
- Review network exposure for MailHog web UI and SMTP listener.
- Check whether untrusted users or systems can send mail into MailHog.
- Inspect logs and message history for unexpected message deletion or suspicious UI behavior.
- Monitor advisory and CVE sources for remediation updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50908 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N3.92.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- ExploitDB-50971CVE reference · exploit
- MailHog GitHub RepositoryCVE reference · product
- Shodan Search Results for MailHogCVE reference · product
- VulnCheck Advisory: Mailhog 1.0.1 - Stored Cross-Site Scripting (XSS)CVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.