CVE-2025-40631 Details
Description
HTTP host header injection vulnerability in Icewarp Mail Server affecting version 11.4.0. By modifying the Host header and adding a payload, arbitrary JavaScript code can be executed on page load. The user must interact with a malicious link to be redirected.
A host header injection vulnerability has been identified in IceWarp Mail Server version 11.4.0. This vulnerability allows the execution of arbitrary JavaScript code on page load by modifying the Host header to include a payload. The exploitation requires user interaction with a malicious link, which, once clicked, redirects the user and executes the injected script.
Users can upgrade to IceWarp Mail Server version 13.0.2 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 16, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-icewarp-mail-server | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-644 | Improper Neutralization of HTTP Headers for Scripting Syntax | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| icewarp mail server | 11.4.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 9, 2025 | Initial Analysis | [email protected] |
| May 16, 2025 | New CVE Received | [email protected] |