Thomas Lancaster

**Name of the Vulnerable Software and Affected Versions** Zimbra Collaboration Suite (ZCS) versions 8.8.15 through 9.0 **Description** The mboximport functionality in Zimbra Collaboration Suite (ZCS) has an authentication bypass issue, allowing an attacker to upload arbitrary files to the system without an authtoken. This can lead to directory traversal and remote code execution. The issue is due to an incomplete fix for a previous vulnerability. **Recommendations** For Zimbra Collaboration Suite (ZCS) versions 8.8.15 through 9.0, consider disabling the mboximport functionality until a patch is available to prevent exploitation. Restrict access to the mboximport module to minimize the risk of remote code execution. Avoid using the mboximport functionality in production environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Zimbra Collaboration Suite versions 8.8.x through 8.8.15 patch 29 **Description** An issue was discovered in the Calendar feature, allowing an attacker to place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document. The issue has been exploited in the wild starting in December 2021. **Recommendations** For Zimbra Collaboration Suite versions 8.8.x through 8.8.15 patch 29, update to version 8.8.15 patch 30 (update 1) to resolve the issue. As a temporary workaround, consider restricting access to the Calendar feature until a patch is available. Avoid using the Calendar feature with untrusted input until the issue is resolved.