Synacor · Zimbra Collaboration Suite (ZCS)
CVE-2025-27915
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
Was es ist
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
Was zu tun ist
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Frist für US-Bundesbehörden: 28. Oktober 2025
Weitere ausgenutzte Schwachstellen von Synacor
| Hinzugefügt | Schwachstelle | Produkt | Schweregrad | Angriffswahrscheinlichkeit |
|---|---|---|---|---|
| 21.08.2026 | OS Command Injection | Zimbra Collaboration Suite (ZCS) | Hoch 8,9 | 72% |
| 20.04.2026 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Mittel 6,1 | 1,7% |
| 18.03.2026 | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | Hoch 7,2 | 20% |
| 07.07.2025 | Server-Side Request Forgery (SSRF) | Zimbra Collaboration Suite (ZCS) | Hoch 7,5 | 81% |
| 19.05.2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Mittel 6,1 | 25% |
| 25.02.2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Kritisch 9,0 | 77% |
| 03.10.2024 | Command Execution | Zimbra Collaboration Suite (ZCS) | Kritisch 10,0 | 99,9% |
| 27.07.2023 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Mittel 6,1 | 49% |
Quellen: Known Exploited Vulnerabilities (CISA, gemeinfrei), CVE records (cve.org) und EPSS (FIRST). Die Angriffswahrscheinlichkeit ist die EPSS-Schätzung, dass jemand in den nächsten 30 Tagen versucht, die Schwachstelle auszunutzen.