CVE-2023-37580mediumunder attackCWE-79

CVE-2023-37580

Published · Updated

70Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 6.1epss 49%
from disclosure to weapon
Published on NVDJul 31
CISA KEVJul 27
exploitation probability
49%top 1% of all CVEs
observed exploitation
yesCISA + VulnCheck
Action required by CISAfederal deadline: 2023-08-17

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

A security flaw in Zimbra Collaboration Server version 8 allows attackers to inject malicious scripts into the Classic Web Client, potentially stealing user credentials or session information when users view affected pages.

Technical detail

Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Server 8.x prior to patch 8.8.15 Patch 41 enables attackers to inject malicious JavaScript code that executes in users' browsers within the Zimbra Classic Web Client context. Exploitation requires user interaction (visiting a malicious link or viewing crafted content), and successful exploitation can lead to session hijacking, credential theft, or unauthorized actions on behalf of the user.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
n/a · n/a
References
https://wiki.zimbra.com/wiki/Security_Centerhttps://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policyhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-37580http://www.openwall.com/lists/oss-security/2023/11/17/2