CVE-2025-40632: Cross-site scripting (XSS) vulnerability in IceWarp Mail Server
Published May 16, 2025
·Updated
Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to modify the “lastLogin” cookie with malicious JavaScript code that will be executed when the page is rendered.
Affected Software
2 affected components
IceWarp Mail Server
IceWarp Mail Server=11.4.0
Remediation
Information
The vulnerabilities have been fixed by the IceWarp team in the 13.0.2 version.
Event History
May 16, 2025
CVE Published
via MITRE·11:09 AM
Data Sourced
via MITRE·11:09 AM
RemedyDescriptionWeakness
Data Sourced
via NVD·11:15 AM
DescriptionSeverityWeaknessAffected Software
Jun 11, 57743
Event
via NVD·11:28 AM
Frequently Asked Questions
1
What is the severity of CVE-2025-40632?
CVE-2025-40632 has a high severity rating due to the potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2025-40632?
To fix CVE-2025-40632, update your Icewarp Mail Server to version 11.4.0 or later with the security patch.
3
What type of attacks can CVE-2025-40632 facilitate?
CVE-2025-40632 can facilitate cross-site scripting (XSS) attacks, allowing attackers to run malicious JavaScript code.
4
Which versions of Icewarp Mail Server are affected by CVE-2025-40632?
Icewarp Mail Server version 11.4.0 is affected by CVE-2025-40632.
5
What impact does CVE-2025-40632 have on users?
CVE-2025-40632 can compromise user data and session integrity by manipulating the 'lastLogin' cookie.