Skip to main content
Apexward Pulse

Rapid7

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

CVE-2025-27915

What this means

This is rated medium severity (5.4 out of 10). It is on the known-exploited catalogue, which means attacks using it have already been seen. Ask IT whether Synacor Zimbra Collaboration Suite is in your estate.

Full vendor description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

Scoring and exploitation

5.4/ 10
CVSS 3.1 base scoreMedium

Exploitable over the network with a low-privilege account, but only if a user takes an action, such as opening a file or link. Low impact on confidentiality and integrity, and it can reach beyond the vulnerable system.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability

Longer bar: easier to attack

Attack vectorNetworkAV:N
Attack complexityLowAC:L
Privileges requiredLowPR:L
User interactionRequiredUI:R
ScopeChangedS:C

Impact

Longer bar: more harm

ConfidentialityLowC:L
IntegrityLowI:L
AvailabilityNoneA:N
~4.1% estimated chance of attack in 30 daysModel estimate (): a probability signal, not confirmed exploitation
Exploited in the wild
Yes — confirmed exploitation (US CISA )
Not reported
Listed product
Synacor Zimbra Collaboration Suite (ZCS)

Weaknesses

CWE-79

Affected products ()

  • Synacor Zimbra Collaboration Suite
Show the raw CPE strings (40)
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*

Showing 25 of 40 matches from .

References

6 links from the CVE record, grouped by site.

Related feed events