Medium severity · published Sep 12, 2023
CVE-2023-41013
Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field
6.1
CVSS
0.6%
EPSS
No
On KEV
Description
Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" field.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
Icewarp · Icewarp
10.3.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-41013
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-41013
medium.com
https://medium.com/@katikitala.sushmitha078/cve-2023-41013-789841dcad91
medium.com
https://medium.com/%40katikitala.sushmitha078/cve-2023-41013-789841dcad91
More from Icewarp
9.8
CVE-2025-14500
IceWarp14 X-File-Operation Command Injection Remote Code Execution Vulnerability
8.8
CVE-2025-14499
IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability
7.5
CVE-2026-2493
IceWarp collaboration Directory Traversal Information Disclosure Vulnerability
6.1
CVE-2018-25269
ICEWARP 11.0.0.0 Cross-Site Scripting via Email HTML Injection
6.1
CVE-2024-55218
IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter