Vulnerability · Published May 16, 2025 · Assigned by INCIBE
CVE-2025-40630Open redirection vulnerability in IceWarp Mail Server
Medium 5.1
In plain English
A medium-severity open redirect in Icewarp Mail Server from Icewarp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com//<MALICIOUS_DOMAIN>/%2e%2e” https://icewarp.domain.com///%2e%2e” . This vulnerability has been tested in Firefox.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Icewarp | Icewarp Mail Server | 11.4.0 |
Weakness: CWE-601 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N