CVE-2023-39600
MediumCVSS 6.1Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
IceWarp version 11.4.6.0 was found to contain a cross-site scripting (XSS) vulnerability via the color parameter.
Risk Assessment
Exploitation of this vulnerability could allow for malicious code execution in the user's context, posing a threat to data security and privacy.
Recommendation
It is recommended to update IceWarp software to the latest version to mitigate this vulnerability.
Other vulnerabilities in IceWarp 11.4.6.0
See all- CVE-2023-41013Medium
Cross Site Scripting (XSS) vulnerability in the Webmail Calendar of IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
- CVE-2023-37728Medium
IceWarp version 10.2.1 was found to have a cross-site scripting (XSS) vulnerability via the color parameter. An attacker can inject malicious JavaScript code that executes in the victim's browser.
Original NVD description (English source)
IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS