CVE-2023-37728

MediumCVSS 6.1

Published: 20/07/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.12%

62th percentile - higher than 62% of all known CVEs

Summary

IceWarp version 10.2.1 was found to have a cross-site scripting (XSS) vulnerability via the color parameter. An attacker can inject malicious JavaScript code that executes in the victim's browser.

Risk Assessment

The risk includes session hijacking, theft of sensitive data, or phishing attacks within the IceWarp application context.

Recommendation

Immediately update IceWarp to the latest available version that fixes this vulnerability. Also consider input validation and sanitization for the color parameter.

Original NVD description (English source)

IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter.