CVE-2023-39600

MEDIUMNuclei

IceWarp 11.4.6.0 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-39600 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 2, 2024 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMIceWarp 11.4.6.0 - Cross-Site ScriptingCVSS 6.1

IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential data theft or unauthorized actions.

Remediation

Apply the latest security patches and updates from the vendor to address this vulnerability.

WeaknessesCWE-79
AuthorsImjust0
Template tagscvecve2023icewarpxssvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:icewarp:icewarp:11.4.6.0:*:*:*:*:*:*:*
Shodan: title:"icewarp"
Shodan: http.favicon.hash:2144485375
Shodan: http.title:"icewarp"
FOFA: title="icewarp"
FOFA: icon_hash=2144485375
Google: intitle:"icewarp"
https://medium.com/@katikitala.sushmitha078/cross-site-scripting-reflected-xss-in-icewarp-server-cve-2023-39600-310a7e1c8817 https://nvd.nist.gov/vuln/detail/CVE-2023-39600 https://icewarp.com/ https://medium.com/%40katikitala.sushmitha078/cross-site-scripting-reflected-xss-in-icewarp-server-cve-2023-39600-310a7e1c8817

Source: ProjectDiscovery

References

5