CVE-2022-27926mediumunder attackCWE-79

CVE-2022-27926

Published · Updated

Follow this CVE+ Monitor Zimbra Collaboration Suite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 6.1epss 18%
from disclosure to weapon
Published on NVDApr 20
CISA KEV+348d
Action required by CISAfederal deadline: 2023-04-24

Apply updates per vendor instructions.

In short

A flaw in Zimbra Collaboration 9.0 allows attackers to inject malicious scripts into web pages through URL parameters, which then execute in users' browsers. This can steal sensitive data or hijack user sessions without any login required.

Technical detail

Reflected XSS vulnerability in /public/launchNewWindow.jsp component exploitable via unsanitized request parameters. Unauthenticated attackers can craft malicious URLs to inject arbitrary JavaScript that executes in victims' browsers, compromising session integrity and enabling credential theft.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
n/a · n/a