CVE-2022-31470

What it actually does

This is a cross-site scripting flaw in Axigen Mobile WebMail's password-reset/change-password page, specifically involving index_mobile_changepass.hsp. An unauthenticated attacker can craft a request or link that causes attacker-controlled JavaScript to execute in a victim user's browser after the user interacts with it. If the victim is already logged in, the script runs in the context of the WebMail application and can use the user's active session to read page content, issue authenticated WebMail requests, and retrieve mailbox data. The vulnerability primarily affects confidentiality and integrity of user webmail sessions; it does not directly provide server-side code execution or service availability impact.

Why it matters to the business

Successful exploitation can expose email contents, attachments, contacts, and potentially password-reset or business-sensitive communications visible through a user's mailbox. Because email accounts are often a recovery channel for other systems, mailbox access can support broader account takeover, fraud, data leakage, and internal phishing. The issue is not listed in CISA KEV and is not marked as ransomware-associated, but the exploit maturity is weaponized and the EPSS score is elevated, so internet-facing WebMail deployments should be treated as a meaningful near-term risk even though the CVSS score is moderate.

How an attack unfolds

An attacker identifies an organization using a vulnerable Axigen Mobile WebMail version and prepares a malicious URL or form targeting the vulnerable reset-password/change-password functionality. The payload is crafted so that JavaScript is reflected or otherwise executed by index_mobile_changepass.hsp in the victim's browser. The attacker then convinces a logged-in user to open the link through phishing, chat, a malicious webpage, or another delivery method. Once executed, the JavaScript runs with the WebMail origin and can interact with the application as the victim, including reading mailbox views or making authenticated requests to retrieve message content. The script can then send selected mailbox data or session-derived information to attacker-controlled infrastructure, often leaving only web, proxy, DNS, WAF, or browser-side telemetry as evidence.

How to fix it

Upgrade Axigen Mobile WebMail to a fixed release: 10.2.3.12 or later for the 10.2 branch, and 10.3.3.47 or later for the 10.3 branch. If possible, move to the latest supported Axigen release rather than only the minimum fixed version. Until patching is complete, restrict external access to WebMail, place the application behind a VPN or identity-aware proxy, enable WAF rules for XSS payload patterns, and consider disabling or limiting mobile WebMail access if operationally feasible. Enforce HttpOnly, Secure, and SameSite cookie attributes where supported, deploy a restrictive Content Security Policy to reduce XSS impact, and review custom reverse-proxy or SSO configurations that may weaken browser protections. The supplied package metadata references chbrown/rfc6902 fixed at commit c006ce9faa43d31edb34924f1df7b79c137096cf; verify asset applicability carefully, because the vulnerability description and remediation for this CVE concern Axigen Mobile WebMail.

How to confirm the fix worked

Confirm the deployed Axigen version from the administrative interface, package manager, build manifest, or vendor-provided version endpoint and verify it is 10.2.3.12 or later, 10.3.3.47 or later, or a newer supported release. Test that index_mobile_changepass.hsp no longer reflects executable HTML or JavaScript by submitting benign encoded XSS test strings and confirming they are safely encoded, rejected, or rendered inert. Review WAF, proxy, and application logs to ensure no active exploit attempts continue after the upgrade. Validate that browser security headers, especially Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, and secure cookie attributes, are present and effective. If compensating controls are used, confirm WebMail is not directly reachable from untrusted networks except through the intended access control layer.

Typical attack path

1. Identify an exposed Axigen Mobile WebMail instance running a version before 10.2.3.12 or a vulnerable 10.3.x version before 10.3.3.47.
2. Craft a malicious URL or request targeting index_mobile_changepass.hsp in the reset-password/change-password workflow with embedded JavaScript payload content.
3. Deliver the link to a target user through phishing, social engineering, a compromised website, or another user-interaction channel.
4. Wait for a user who has an active WebMail session to open the crafted content.
5. Execute JavaScript in the victim browser under the trusted WebMail origin.
6. Use the victim's authenticated session to access mailbox views, message content, contacts, or related WebMail resources.
7. Exfiltrate selected data to attacker-controlled infrastructure or use the compromised email context for follow-on phishing and account takeover.

How to detect it

To determine whether exploitation already occurred, review web server, reverse-proxy, WAF, load balancer, and application logs for requests to index_mobile_changepass.hsp or reset-password/change-password paths containing HTML tags, JavaScript schemes, event-handler attributes, or URL-encoded equivalents. Correlate suspicious requests with authenticated WebMail activity from the same user session shortly afterward, such as rapid mailbox browsing, message opening, attachment access, contact export, forwarding-rule changes, or access to many messages in a short period. Review secure web gateway, DNS, EDR, and browser telemetry for affected users to identify outbound connections to unfamiliar domains immediately after visiting WebMail reset/change-password links, since exfiltration from XSS usually leaves the victim browser rather than the mail server. Check CSP violation reports if deployed, as they may directly record blocked inline script execution or exfiltration destinations. Investigate phishing emails, chat messages, or tickets containing WebMail links with encoded parameters. Because exploitation requires user interaction and an active session, prioritize users who received suspicious links and were logged in around the time of the request.

• index_mobile_changepass.hsp
• reset-password
• changepass
• <script
• %3Cscript
• </script>
• %3C%2Fscript%3E
• javascript:
• %6a%61%76%61%73%63%72%69%70%74%3a
• onerror=
• onload=
• onclick=
• document.cookie
• localStorage
• sessionStorage
• XMLHttpRequest
• fetch(
• eval(
• atob(
• btoa(
• new Image().src
• img src=x onerror
• svg onload
• <iframe
• %3Ciframe
• <svg
• %3Csvg
• alert(
• prompt(
• confirm(
• index_mobile_changepass.hsp?

What your security team should do

• Prioritize patching internet-facing Axigen Mobile WebMail systems because exploit code is considered weaponized and the EPSS score indicates elevated likelihood of exploitation.
• Inventory all WebMail instances and confirm whether any are running versions before 10.2.3.12 or 10.3.x before 10.3.3.47.
• Search recent web, WAF, reverse-proxy, DNS, endpoint, and secure web gateway logs for attempts against index_mobile_changepass.hsp containing script-like or encoded payloads.
• Review mailbox access patterns for users who clicked suspicious links, including unusual message reads, exports, forwarding-rule changes, contact access, or access immediately after reset-password page requests.
• Temporarily restrict WebMail exposure to trusted networks or VPN until patching and validation are complete.
• Enable or tune WAF and CSP protections to block common XSS payloads and report attempted script execution.
• Notify help desk and messaging administrators to watch for user reports of suspicious WebMail links, unexpected password-change pages, or unusual mailbox activity.
• If exploitation is suspected, reset affected user sessions and credentials, revoke persistent tokens where applicable, inspect mailbox rules/delegates/forwarders, and preserve relevant logs for investigation.