CVE-2025-14499

Published Dec 23, 2025

Last updated 4 months ago

IceWarp

IceWarp gmaps

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-14499 is identified as an IceWarp gmaps Cross-Site Scripting (XSS) Authentication Bypass Vulnerability. This flaw enables remote attackers to bypass authentication on affected installations of IceWarp. The vulnerability stems from improper validation of user-supplied data within a parameter passed to the gmaps webpage, allowing for the injection of arbitrary scripts. Exploitation requires user interaction, as the target must visit a malicious page or open a malicious file.

Description: IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of IceWarp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of a parameter passed to the gmaps webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25441.
Source: zdi-disclosures@trendmicro.com
NVD status: Deferred

Risk scores

CVSS 3.0

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

zdi-disclosures@trendmicro.com: CWE-79

Hype score: Not currently trending

References