Reflected Cross-Site Scripting Vulnerability in IceWarp Mail Server
CVE-2023-39700

6.1MEDIUM

Key Information:

Vendor

Icewarp

Status
Mail Server
Vendor
CVE Published:
25 August 2023

What is CVE-2023-39700?

A vulnerability has been identified in IceWarp Mail Server v10.4.5, which allows attackers to exploit reflected cross-site scripting (XSS) via the color parameter. This type of vulnerability can lead to unauthorized actions being performed on behalf of unsuspecting users, potentially compromising user data and application integrity. Attackers might craft malicious links that, when clicked, execute arbitrary script code in the context of a user's session. It is crucial for administrators and users to be aware of this vulnerability and implement appropriate security measures.

References

https://cwe.mitre.org/data/definitions/79.html
https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-...
https://drive.google.com/file/d/1QL_517UbTFJox4CXKQpP9feh...

EPSS Score

10% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.