CVE-2023-37728

MediumCVSS 6.1

Published: 20/07/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.12%

62th percentile - higher than 62% of all known CVEs

Summary

IceWarp version 10.2.1 was found to have a cross-site scripting (XSS) vulnerability via the color parameter. An attacker can inject malicious JavaScript code that executes in the victim's browser.

Risk Assessment

The risk includes session hijacking, theft of sensitive data, or phishing attacks within the IceWarp application context.

Recommendation

Immediately update IceWarp to the latest available version that fixes this vulnerability. Also consider input validation and sanitization for the color parameter.

Other vulnerabilities in IceWarp

See all

CVE-2023-41013Medium
Cross Site Scripting (XSS) vulnerability in the Webmail Calendar of IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
CVE-2023-39600Medium
IceWarp version 11.4.6.0 was found to contain a cross-site scripting (XSS) vulnerability via the color parameter.

Original NVD description (English source)

IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS