LiveActive security incident?Get immediate response
CVE Record

CVE-2021-36580: Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) v...

Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This CVE describes an open redirect in IceWarp MailServer/IceWarp Server Deep Castle 2 Update 1, version 13.0.1.2, involving a referer parameter. Attackers could potentially use a trusted IceWarp URL to send users to another site, supporting phishing or credential theft.

Executive priority

Treat this as a phishing-enablement risk, not a standalone system takeover based on current evidence. Prioritize verification and vendor guidance if IceWarp is internet-facing or used for executive, finance, or privileged mail access.

Technical view

The public record identifies an open redirect via the referer parameter in the named IceWarp MailServer/IceWarp Server release. The bundle provides no CVSS score, CWE mapping, vendor advisory, patch level, or structured affected CPEs, so technical scope and fixed versions remain incomplete.

Likely exposure

Exposure is most relevant where the affected IceWarp web interface is reachable by users or the internet. The structured affected-product data is incomplete, so teams should verify exact IceWarp Server versions internally.

Exploitation context

The provided sources do not show active exploitation, and KEV is false. Open redirects are commonly useful in phishing chains, but the bundle does not establish weaponized campaigns or exploitation at scale.

Researcher notes

The record is sparse: no CVSS, CWE, CPE, vendor confirmation, or remediation details are included. The product/version appears in the title and description, while structured affected fields are unavailable, limiting precise exposure matching.

Mitigation direction

  • Check IceWarp vendor guidance for fixed versions or recommended mitigations.
  • Inventory IceWarp MailServer/IceWarp Server deployments and identify version 13.0.1.2.
  • Restrict external access to affected web interfaces where business allows.
  • Monitor authentication and mail logs for suspicious referral or login patterns.

Validation and detection

  • Confirm whether any IceWarp deployment matches Deep Castle 2 Update 1 version 13.0.1.2.
  • Review public-facing IceWarp URLs and authentication entry points.
  • Check whether vendor release notes mention this CVE or open redirect fixes.
  • Verify compensating controls for phishing-resistant MFA and external access restrictions.
Prepared
Confidence
medium
Sources
3

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-36580 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
3Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.