Cross-Site Scripting Vulnerability in IceWarp Mail Server by IceWarp
CVE-2017-12844

4.8MEDIUM

Key Information:

Vendor

Icewarp

Status
Mail Server
Vendor
CVE Published:
23 August 2017

What is CVE-2017-12844?

An XSS vulnerability exists in the admin panel of IceWarp Mail Server version 10.4.4. This flaw permits remote authenticated domain administrators to inject arbitrary web scripts or HTML by manipulating user names. Such an exploit could lead to unauthorized access and potentially compromise the security of the server, allowing attackers to execute harmful scripts in the context of other users.

References

https://youtu.be/MI4dhEia1d4
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.