CVE-2023-37580
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Jul 27, 2023
- US federal agencies must remediate it by Aug 17, 2023 (BOD 22-01)
- Attacked 33 days before the vulnerability was made public
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Source: CISA KEV · May 21, 2024 May 14, 2024 Feb 2, 2024 Nov 16, 2023 Jul 27, 2023 Jul 13, 2023
CVSS score6.1 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWeakness type (CWE)CWE-79, CWE-79
Vendorssynacor
Affected products
| Vendors | Product | Versions |
|---|---|---|
| synacor | zimbra collaboration suite | < 8.8.15 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.