IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability

A cross-site scripting vulnerability allowing authentication bypass has been identified in IceWarp. This issue arises from improper validation of user-supplied data in a parameter passed to the gmaps webpage, enabling the injection of arbitrary scripts. Exploitation requires user interaction, as the target must visit a malicious page or open a harmful file.

Impact

Exploitation of this vulnerability allows remote attackers to bypass authentication on affected IceWarp installations.

Remediation

IceWarp has released an update to address this vulnerability. Details can be found in the IceWarp community post titled 'EPOS - Update 2 build 8 (14.2.0.8)'