BLACKOUT MAP

Synacor · Zimbra Collaboration Suite (ZCS)

CVE-2023-34192

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Exploited in attacks Critical 9.0 Attack chance: 77%
Share

What it is

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: March 18, 2025

Added to the CISA list
February 25, 2025
Published
July 6, 2023
Severity
Critical 9.0 CVSS 3.1
Chance of attacks in the next 30 days (EPSS)
77% in the top 0.4% of all known vulnerabilities
Weakness
CWE-79
More details
NVD · CVE.org · CISA
All references (3)

More exploited flaws from Synacor

AddedVulnerabilityProductSeverityAttack chance
Aug 21, 2026OS Command InjectionCVE-2026-73570Zimbra Collaboration Suite (ZCS)High 8.972%
Apr 20, 2026Cross-site ScriptingCVE-2025-48700Zimbra Collaboration Suite (ZCS)Medium 6.11.7%
Mar 18, 2026Cross-Site ScriptingCVE-2025-66376Zimbra Collaboration Suite (ZCS)High 7.220%
Oct 7, 2025Cross-site ScriptingCVE-2025-27915Zimbra Collaboration Suite (ZCS)Medium 5.44.1%
Jul 7, 2025Server-Side Request Forgery (SSRF)CVE-2019-9621Zimbra Collaboration Suite (ZCS)High 7.581%
May 19, 2025Cross-Site Scripting (XSS)CVE-2024-27443Zimbra Collaboration Suite (ZCS)Medium 6.125%
Oct 3, 2024Command ExecutionCVE-2024-45519Zimbra Collaboration Suite (ZCS)Critical 10.099.9%
Jul 27, 2023Cross-Site Scripting (XSS)CVE-2023-37580Zimbra Collaboration Suite (ZCS)Medium 6.149%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.