Skip to main content

Icewarp CVE-2025-40631

LOW
Improper Neutralization of HTTP Headers for Scripting Syntax (CWE-644)
2025-05-16 cve-coordination@incibe.es
RCE Icewarp Mail Server
2.0
CVSS 4.0 · NVD

Severity by source

NVD PRIMARY
2.0 LOW
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

2
Analysis Generated
Mar 28, 2026 - 18:42 vuln.today
CVE Published
May 16, 2025 - 11:15 nvd
LOW 2.0

DescriptionCVE.org

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected.

AnalysisAI

HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. Rated low severity (CVSS 2.0), this vulnerability is no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-644. HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected. Affected products include: Icewarp Mail Server. Version information: version 11.4.0..

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Icewarp

View all
CVE-2023-39699 CRITICAL POC
9.8 Aug 25

IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /cale
CVE-2019-12593 HIGH POC
7.5 Jun 03

IceWarp Mail Server through 10.4.4 is prone to a local file inclusion vulnerability via webmail/calendar/minimizer/index
CVE-2021-36580 MEDIUM POC
6.1 Jul 27

Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the refere
CVE-2023-37728 MEDIUM POC
6.1 Jul 20

IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter. Rated medium
CVE-2017-7855 MEDIUM POC
6.1 Aug 31

In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
CVE-2024-55218 MEDIUM POC
6.1 Jan 07

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting (XSS) via the meta parameter. Rated medium severity (CVSS 6.
CVE-2023-40779 MEDIUM POC
6.1 Sep 14

An issue in IceWarp Mail Server Deep Castle 2 v.13.0.1.2 allows a remote attacker to execute arbitrary code via a crafte
CVE-2023-39598 MEDIUM POC
6.1 Sep 05

Cross Site Scripting vulnerability in IceWarp Corporation WebClient v.10.2.1 allows a remote attacker to execute arbitra
CVE-2023-39600 MEDIUM POC
6.1 Aug 25

IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter. Rated med
CVE-2023-39700 MEDIUM POC
6.1 Aug 25

IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color
CVE-2020-27982 MEDIUM POC
6.1 Nov 02

IceWarp 11.4.5.0 allows XSS via the language parameter. Rated medium severity (CVSS 6.1), this vulnerability is remotely
CVE-2020-8512 MEDIUM POC
6.1 Feb 01

In IceWarp Webmail Server through 11.4.4.1, there is XSS in the /webmail/ color parameter. Rated medium severity (CVSS 6

Same weakness CWE-644 – Improper Neutralization of HTTP Headers for Scripting Syntax

View all
CVE-2026-26747 CRITICAL POC
9.1
CVE-2026-26234 HIGH POC
8.8
CVE-2025-64425 HIGH POC
8.1
CVE-2024-1064 HIGH POC
7.5
CVE-2024-39736 CRITICAL
9.8
CVE-2025-70948 CRITICAL
9.3
CVE-2017-6031 HIGH
8.8
CVE-2026-33805 CRITICAL
9.0

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

CVE-2025-40631 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy