CVE-2021-36580

MediumCVSS 6.1

Published: 27/07/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.53%

72th percentile - higher than 72% of all known CVEs

Summary

An Open Redirect vulnerability has been found in IceWarp MailServer Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter. An attacker can exploit this flaw to redirect users to a malicious website.

Risk Assessment

The risk involves potential phishing or social engineering attacks, where victims may be redirected to a fake login page or other malicious site.

Recommendation

It is recommended to upgrade IceWarp MailServer to the latest version that fixes this vulnerability. Additionally, consider validating the referer parameter on the server side.

Original NVD description (English source)

Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter.