Zimbra Collaboration Suite Zcs
Monthly
Zimbra Collaboration Suite's Classic web client is vulnerable to stored cross-site scripting via iCalendar COUNTER messages, allowing an unauthenticated remote attacker to inject active markup into the RFC From address and execute scripts when a victim selects the message, leading to mailbox data theft and session hijacking. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) yields a 9.3 base score; exploitation requires the victim to use the legacy Classic UI and open the crafted message, while the modern UI is unaffected. No public exploit code has been identified at time of analysis, but the low complexity and high impact warrant urgent remediation.
Unauthenticated remote attackers who can reach an existing publicly shared Briefcase document can abuse unsigned save fields in Zimbra Collaboration Suite's OnlyOffice/Document Editing integration to perform path-traversal writes and execute commands as the zimbra service account. Exploitation is contingent on the non-default OnlyOffice/Document Editing add-on being enabled and on a supported Briefcase document being publicly accessible, so the 9.8 score in the source feed (AV:N/AC:L) is moderated by an independent assessment that rates attack complexity as High (AC:H) given those prerequisites. No public exploit code or confirmed active exploitation was identified at time of analysis, and no patched version could be confirmed from the single Zimbra wiki advisory reference provided.
Stored cross-site scripting in Zimbra Collaboration Suite's Modern web client lets an unauthenticated sender forge a share notification; a signed-in recipient must click Accept Share, after which attacker-controlled script executes in the victim's Zimbra session and can access mailbox data and act as that user. The issue is rated CVSS 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), with the required user interaction and Modern-client precondition limiting exposure to users who act on the forged notification; no public exploit was identified in the provided data.
Stored cross-site scripting in Zimbra Collaboration Suite (ZCS) Classic webmail lets an unauthenticated sender forge a share notification that, once a signed-in recipient clicks 'Accept Share', executes attacker-supplied script inside that victim's authenticated session - exposing mailbox contents and allowing the attacker to act with the victim's privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 9.3) reflects a remotely reachable, low-complexity attack requiring no attacker credentials but one act of victim interaction, with scope change and high confidentiality and integrity impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low bar to delivery and the high value of mailbox access make it a priority for ZCS Classic deployments. Reported through Rapid7, with tracking rooted in CWE-79 (improper neutralization of input during web page generation).
Zimbra Collaboration Suite's Classic web client is vulnerable to stored cross-site scripting via iCalendar COUNTER messages, allowing an unauthenticated remote attacker to inject active markup into the RFC From address and execute scripts when a victim selects the message, leading to mailbox data theft and session hijacking. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) yields a 9.3 base score; exploitation requires the victim to use the legacy Classic UI and open the crafted message, while the modern UI is unaffected. No public exploit code has been identified at time of analysis, but the low complexity and high impact warrant urgent remediation.
Unauthenticated remote attackers who can reach an existing publicly shared Briefcase document can abuse unsigned save fields in Zimbra Collaboration Suite's OnlyOffice/Document Editing integration to perform path-traversal writes and execute commands as the zimbra service account. Exploitation is contingent on the non-default OnlyOffice/Document Editing add-on being enabled and on a supported Briefcase document being publicly accessible, so the 9.8 score in the source feed (AV:N/AC:L) is moderated by an independent assessment that rates attack complexity as High (AC:H) given those prerequisites. No public exploit code or confirmed active exploitation was identified at time of analysis, and no patched version could be confirmed from the single Zimbra wiki advisory reference provided.
Stored cross-site scripting in Zimbra Collaboration Suite's Modern web client lets an unauthenticated sender forge a share notification; a signed-in recipient must click Accept Share, after which attacker-controlled script executes in the victim's Zimbra session and can access mailbox data and act as that user. The issue is rated CVSS 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), with the required user interaction and Modern-client precondition limiting exposure to users who act on the forged notification; no public exploit was identified in the provided data.
Stored cross-site scripting in Zimbra Collaboration Suite (ZCS) Classic webmail lets an unauthenticated sender forge a share notification that, once a signed-in recipient clicks 'Accept Share', executes attacker-supplied script inside that victim's authenticated session - exposing mailbox contents and allowing the attacker to act with the victim's privileges. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, base 9.3) reflects a remotely reachable, low-complexity attack requiring no attacker credentials but one act of victim interaction, with scope change and high confidentiality and integrity impact. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, but the low bar to delivery and the high value of mailbox access make it a priority for ZCS Classic deployments. Reported through Rapid7, with tracking rooted in CWE-79 (improper neutralization of input during web page generation).