CVE-2023-41013
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in the Webmail Calendar of IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
Risk Assessment
An attacker can steal user sessions, redirect users to malicious sites, or perform other harmful actions within the context of their browser.
Recommendation
It is recommended to immediately update IceWarp to the latest version and apply input filters for the "p4" field in the Webmail Calendar.
Other vulnerabilities in IceWarp
See all- CVE-2023-39600Medium
IceWarp version 11.4.6.0 was found to contain a cross-site scripting (XSS) vulnerability via the color parameter.
- CVE-2023-37728Medium
IceWarp version 10.2.1 was found to have a cross-site scripting (XSS) vulnerability via the color parameter. An attacker can inject malicious JavaScript code that executes in the victim's browser.
Original NVD description (English source)
Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS