Type Vulnerability
Business Email Compromise (BEC) operates on a familiar playbook. Known-exploited catalogue reports exploitation in the wild.
Rapid7
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
CVE-2023-37580
What this means
This is rated medium severity (6.1 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Synacor Zimbra Collaboration Suite is in your estate.
Full vendor description
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
Scoring and exploitation
6.1/ 10
CVSS 3.1 base scoreMedium
Exploitable over the network without any account, but only if a user takes an action, such as opening a file or link. Low impact on confidentiality and integrity, and it can reach beyond the vulnerable system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Exploitability
Longer bar: easier to attack
Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredNonePR:N
User interactionRequiredUI:R
ScopeChangedS:C
Impact
Longer bar: more harm
ConfidentialityLowC:L
IntegrityLowI:L
AvailabilityNoneA:N
- Elevated attack likelihood (~49.1% in 30 days)Model estimate (): a probability signal, not confirmed exploitation
- Exploited in the wild
- Yes — confirmed exploitation (US CISA )
- Not reported
- Listed product
- Synacor Zimbra Collaboration Suite (ZCS)
Weaknesses
CWE-79
Affected products ()
- Synacor Zimbra Collaboration Suite
Show the raw CPE strings (14)
- cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p34:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p35:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p37:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p38:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p40:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*
References
7 links from the CVE record, grouped by site.
openwall.com1 link
- 2 (opens in a new tab)Mailing List · Patch
wiki.zimbra.com2 links
- Security_Center (opens in a new tab)Release Notes
- Zimbra_Responsible_Disclosure_Policy (opens in a new tab)Not Applicable
cisa.gov1 link
- known-exploited-vulnerabilities-catalog (opens in a new tab)US Government Resource