SOGo vulnerabilities
4 known vulnerabilities in SOGo from Alinto. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.4 High severity
sogo: Improper Restriction of Excessive Authentication Attempts
SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows attackers who already possess a victim's password to brute-force the second-factor code without triggering any lockout. Attackers can send repeate
- 7.4 High severity
sogo: Improper Restriction of Excessive Authentication Attempts
SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint witho
- 8.3 High severity
SOGo: Weak Password Recovery Mechanism for Forgotten Password
SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a
- 7.1 High severity
SOGo: Improper Neutralization of Special Elements used in an SQL Command
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin.