cyfenced.com →

[ CVE-2023-37580 · Published 31 Jul 2023 ]

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Exploited · CISA KEV CVSS 6.1 EPSS 49%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2023-07-27
  • EPSS: 49% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 17 Aug 2023): Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

[ References ]References