Synacor · Zimbra Collaboration Suite (ZCS)
CVE-2025-27915
Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability
چیست
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
چه باید کرد
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
مهلت برای نهادهای فدرال آمریکا: ۲۸ اکتبر ۲۰۲۵
آسیب‌پذیری‌های دیگر Synacor که مورد سوءاستفاده‌اند
| افزوده‌شده | آسیب‌پذیری | محصول | شدت | احتمال حمله |
|---|---|---|---|---|
| ۲۱ اوت ۲۰۲۶ | OS Command Injection | Zimbra Collaboration Suite (ZCS) | بالا ۸٫۹ | ۷۲% |
| ۲۰ آوریل ۲۰۲۶ | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | متوسط ۶٫۱ | ۱٫۷% |
| ۱۸ مارس ۲۰۲۶ | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | بالا ۷٫۲ | ۲۰% |
| ۷ ژوئیه ۲۰۲۵ | Server-Side Request Forgery (SSRF) | Zimbra Collaboration Suite (ZCS) | بالا ۷٫۵ | ۸۱% |
| ۱۹ مه ۲۰۲۵ | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | متوسط ۶٫۱ | ۲۵% |
| ۲۵ فوریه ۲۰۲۵ | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | بحرانی ۹٫۰ | ۷۷% |
| ۳ اکتبر ۲۰۲۴ | Command Execution | Zimbra Collaboration Suite (ZCS) | بحرانی ۱۰٫۰ | ۹۹٫۹% |
| ۲۷ ژوئیه ۲۰۲۳ | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | متوسط ۶٫۱ | ۴۹% |
منابع: Known Exploited Vulnerabilities (CISA، مالکیت عمومی)، CVE records (cve.org) و EPSS (FIRST). احتمال حمله برآورد EPSS از این است که کسی در ۳۰ روز آینده برای سوءاستفاده از این آسیب‌پذیری تلاش کند.