Log in / Sign up

Vulnerability details

CVE-2025-27915

Actively exploited
Synacor Zimbra Collaboration Suite (ZCS)
CVSS 3.1
5.4Medium

Remedy

Required action (CISA): Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (due: 2025-10-28)

Official description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

CVSS scores

ScoreVersionSourceVector
5.4Medium 3.1 CISA ADP / Vulnrichment (CISA-ADP) CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

VendorProductVersionsSource
No product information recorded.

References and advisories

6
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2025-03-12
Last updated
2026-02-26
State
Published
Assigner (CNA)
mitre
Kolun priority
71 · High

CISA KEV catalog

Date added
2025-10-07
Due date
2025-10-28
Used in ransomware
Unknown

Exploit prediction (EPSS)

4.06%
Probability of exploitation in 30 days
90.7%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Active
Technical impact
Total

Weaknesses (CWE)

  • CWE-79
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')