Cross-Site Scripting Vulnerability in IceWarp Mail Server
CVE-2018-7475

6.1MEDIUM

Key Information:

Vendor

Icewarp

Status
Mail Server
Vendor
CVE Published:
30 June 2018

What is CVE-2018-7475?

The IceWarp Mail Server version 12.0.3 contains a security flaw that enables remote attackers to exploit webdav/ticket URIs through cross-site scripting (XSS). This vulnerability permits unauthorized users to inject and execute arbitrary web scripts or HTML on the affected server, potentially compromising user data and leading to further attacks. Organizations utilizing this version should implement immediate security measures to prevent exploitation of this vulnerability.

References

https://0xd0ff9.wordpress.com/2018/06/21/cve-2018-7475/
x_refsource_MISC
https://www.youtube.com/watch?v=8_3Q80JrMm4
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.