CVE-2023-39700

Deeper analysis

IceWarp Mail Server version 10.4.5 contains a reflected cross-site scripting vulnerability in the color parameter, classified under CWE-79. The flaw carries a CVSS 3.1 base score of 6.1 with an attack vector of network, low complexity, no required privileges, and required user interaction, resulting in limited confidentiality and integrity impact within a changed scope.

An unauthenticated remote attacker can craft a malicious URL containing executable script in the color parameter and deliver it to a victim; when the link is followed, the script executes in the context of the mail server application, enabling actions such as session token theft or limited interface manipulation.

The listed references consist of standard CWE-79 and OWASP XSS documentation plus a shared technical file, but contain no vendor advisory, patch information, or mitigation steps. The associated EPSS values have stayed within a moderate band between 0.1197 and 0.1374 without a pronounced upward trajectory after disclosure.