CVE-2011-3579
server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote...
CVE-2011-3579 is a medium vulnerability (CVSS 6.4) in Icewarp Mail Server, published September 30, 2011. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.78%, the 91st percentile. No source names a fixed version.
server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference.
Exploit likelihood
What each source reports
NVD Score used
server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference.
- Record
CVE-2011-3579- CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:P - Weakness
- CWE-399
- Updated
- 2026-11-02
CVE List No score
server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference.
- Record
CVE-2011-3579- Updated
- 2026-11-02
EUVDEUVD-2011-3542 No score
server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference.
- Record
EUVD-2011-3542- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7pr7-2x33-78rj No score
server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote...
server/webmail.php in IceWarp WebMail in IceWarp Mail Server before 10.3.3 allows remote attackers to read arbitrary files, and possibly send HTTP requests to intranet servers or cause a denial of service (CPU and memory consumption), via an XML external entity declaration in conjunction with an entity reference.
- Record
GHSA-7pr7-2x33-78rj- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | IceWarp Mail Server 10.3.2 server/webmail.php Soap Message Parsing - Arbitrary File Disclosure | 2011-09-24 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, Exploit-DB, GitHub Advisories, NVD |
References
archives.neohapsis.com/archives/bugtraq/2011-09/0145.html
securityfocus.com/bid/49753
trustwave.com/spiderlabs/advisories/TWSL2011-013.txt
exchange.xforce.ibmcloud.com/vulnerabilities/70025
securityreason.com/securityalert/8404
osvdb.org/75721
securitytracker.com/id?1026093
nvd.nist.gov/vuln/detail/CVE-2011-3579
github.com/advisories/GHSA-7pr7-2x33-78rj