IceWarp Server Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in IceWarp Server version 10.2.1. The issue arises in the meta parameter, allowing attackers to inject malicious scripts that are executed immediately when the crafted URL is visited. This could lead to session hijacking, cookie theft, or other attacks.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where injected scripts are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, inject an XSS payload into the meta parameter of a URL directed at an IceWarp Server 10.2.1 instance. When the URL is accessed, the payload will execute, confirming the vulnerability.