CVE-2025-14499

{
  "id": "CVE-2025-14499",
  "sourceIdentifier": "[email protected]",
  "published": "2025-12-23T22:15:51.267",
  "lastModified": "2026-10-19T22:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of IceWarp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the handling of a parameter passed to the gmaps webpage. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-25441."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de omisión de autenticación y Cross-site Scripting (XSS) en gmaps de IceWarp. Esta vulnerabilidad permite a atacantes remotos omitir la autenticación en instalaciones afectadas de IceWarp. Se requiere interacción del usuario para explotar esta vulnerabilidad, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso.\\n\\nEl defecto específico existe en el manejo de un parámetro pasado a la página web gmaps. El problema se debe a la falta de validación adecuada de los datos suministrados por el usuario, lo que puede provocar la inyección de un script arbitrario. Un atacante puede aprovechar esta vulnerabilidad para omitir la autenticación en el sistema. Fue ZDI-CAN-25441."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "IceWarp",
          "product": "IceWarp",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "14.2.0.5",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-12-29T18:05:17.510538Z",
          "id": "CVE-2025-14499",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.icewarp.com/hc/en-us/community/posts/40040542307729-EPOS-Update-2-build-8-14-2-0-8",
      "source": "[email protected]"
    },
    {
      "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1071/",
      "source": "[email protected]"
    }
  ]
}