PT-2025-3101 · Icewarp · Icewarp Server

Published 2025-01-07 · Updated 2025-10-02 · CVE-2024-55218

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IceWarp Server version 10.2.1

Description The issue is related to Cross Site Scripting (XSS) and can be exploited via the meta parameter. This allows for malicious scripts to be injected into websites, potentially leading to unauthorized access or control.

Recommendations For IceWarp Server version 10.2.1, consider restricting access to the meta parameter until a patch is available. As a temporary workaround, avoid using the meta parameter in sensitive operations to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-55218

Affected Products

Icewarp Server

References · 7

• 🔥 https://resources.s4e.io/blog/icewarp-server-10-2-1-reflected-xss-vulnerability-cve-2024-55218 · Exploit
• https://osv.dev/vulnerability/CVE-2024-55218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-55218 · Security Note
• https://twitter.com/CVEnew/status/1876953364811894952 · Twitter Post
• https://t.me/cveNotify/137223 · Telegram Post
• https://t.me/cvedetector/14602 · Telegram Post
• https://icewarp.com · Note