Cross Site Scripting Vulnerability in IceWarp WebClient
CVE-2023-43319

6.1MEDIUM

Key Information:

Vendor

Icewarp

Status
Webclient
Vendor
CVE Published:
25 September 2023

What is CVE-2023-43319?

A Cross Site Scripting (XSS) vulnerability exists in the Sign-In page of IceWarp WebClient version 10.3.5. Attackers can exploit this flaw by injecting a crafted payload into the username parameter, enabling the execution of arbitrary web scripts or HTML. This can lead to unauthorized actions on behalf of users and compromise the integrity of sensitive data.

References

https://medium.com/%40muthumohanprasath.r/reflected-cross...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.