CVE-2023-39699
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.
Risk Assessment
This vulnerability may lead to unauthorized access to sensitive data on the server, posing a serious security threat to the organization.
Recommendation
It is recommended to update the IceWarp server to the latest version to mitigate this vulnerability and conduct a security audit of the system.
Original NVD description (English source)
IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.