CVE-2023-41013

MediumCVSS 6.1

Published: 12/09/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.47%

37th percentile - higher than 37% of all known CVEs

Summary

Cross Site Scripting (XSS) vulnerability in the Webmail Calendar of IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.

Risk Assessment

An attacker can steal user sessions, redirect users to malicious sites, or perform other harmful actions within the context of their browser.

Recommendation

It is recommended to immediately update IceWarp to the latest version and apply input filters for the "p4" field in the Webmail Calendar.

Original NVD description (English source)

Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.