BLACKOUT MAP

Synacor · Zimbra Collaboration Suite (ZCS)

CVE-2023-37580

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Exploited in attacks Medium 6.1 Attack chance: 49%
Share

What it is

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability impacting the confidentiality and integrity of data.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: August 17, 2023

Added to the CISA list
July 27, 2023
Published
July 31, 2023
Severity
Medium 6.1 CVSS 3.1
Chance of attacks in the next 30 days (EPSS)
49% in the top 1.1% of all known vulnerabilities
Weakness
CWE-79
More details
NVD · CVE.org · CISA
All references (3)

More exploited flaws from Synacor

AddedVulnerabilityProductSeverityAttack chance
Aug 21, 2026OS Command InjectionCVE-2026-73570Zimbra Collaboration Suite (ZCS)High 8.972%
Apr 20, 2026Cross-site ScriptingCVE-2025-48700Zimbra Collaboration Suite (ZCS)Medium 6.11.7%
Mar 18, 2026Cross-Site ScriptingCVE-2025-66376Zimbra Collaboration Suite (ZCS)High 7.220%
Oct 7, 2025Cross-site ScriptingCVE-2025-27915Zimbra Collaboration Suite (ZCS)Medium 5.44.1%
Jul 7, 2025Server-Side Request Forgery (SSRF)CVE-2019-9621Zimbra Collaboration Suite (ZCS)High 7.581%
May 19, 2025Cross-Site Scripting (XSS)CVE-2024-27443Zimbra Collaboration Suite (ZCS)Medium 6.125%
Feb 25, 2025Cross-Site Scripting (XSS)CVE-2023-34192Zimbra Collaboration Suite (ZCS)Critical 9.077%
Oct 3, 2024Command ExecutionCVE-2024-45519Zimbra Collaboration Suite (ZCS)Critical 10.099.9%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.