Security Flaw in Mailcow's Password Reset Feature Affects Users
CVE-2025-25198
Key Information:
- Vendor
Mailcow
- Status
- Vendor
- CVE Published:
- 12 February 2025
Badges
What is CVE-2025-25198?
mailcow: dockerized, an open source groupware and email suite, has a vulnerability in its password reset functionality prior to version 2025-01a. This flaw allows malicious actors to modify the Host HTTP header, leading to the generation of a password reset link that redirects users to a domain controlled by the attacker. If a user clicks on this link, they could inadvertently compromise their account. Users are advised to upgrade to version 2025-01a, which contains a fix for this vulnerability. Alternatively, to mitigate risks, users can disable the password reset feature by removing values from the Notification email sender and Notification email subject in the system configuration settings.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
mailcow-dockerized < 2025-01a
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved