PT-2023-4007 · Zimbra · Zimbra Collaboration

Published 2023-07-17 · Updated 2025-10-31 · CVE-2023-37580

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions 8.0.0 through 8.8.15 Patch 40 Zimbra Collaboration (ZCS) versions prior to 8.8.15 Patch 41

Description The issue is related to a Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic Web Client. This vulnerability may allow a remote attacker to conduct inter-site scripting attacks. There have been real-world incidents where this issue was exploited, including a zero-day attack targeting a government organization in Greece.

Recommendations For Zimbra Collaboration (ZCS) versions 8.0.0 through 8.8.15 Patch 40, update to version 8.8.15 Patch 41 or later to resolve the issue. For Zimbra Collaboration (ZCS) versions prior to 8.8.15 Patch 41, update to version 8.8.15 Patch 41 or later to resolve the issue. As a temporary workaround, consider disabling the Zimbra Classic Web Client until a patch is available. Restrict access to the Zimbra Classic Web Client to minimize the risk of exploitation.

Fix

Special Elements Injection

XSS

Weakness Enumeration

CWE-74

CWE-79

Related Identifiers

BDU:2023-04305

CVE-2023-37580

Affected Products

Zimbra Collaboration

References · 31

• https://nvd.nist.gov/vuln/detail/CVE-2023-37580 · Security Note
• https://bdu.fstec.ru/vul/2023-04305 · Security Note
• https://wiki.zimbra.com/wiki/Security_Center · Security Note
• https://osv.dev/vulnerability/CVE-2023-37580 · Vendor Advisory
• http://openwall.com/lists/oss-security/2023/11/17/2 · Patch
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37580 · Note
• https://cisa.gov/news-events/alerts/2023/07/27/cisa-adds-one-known-exploited-vulnerability-catalog · Note
• https://t.me/cveNotify/140464 · Telegram Post
• https://t.me/true_secator/5097 · Telegram Post
• https://twitter.com/ProPakistaniPK/status/1732694509450899699 · Twitter Post
• https://blog.google/threat-analysis-group/zimbra-0-day-used-to-target-international-government-organizations · Note
• https://t.me/aptreports/13532 · Telegram Post
• https://twitter.com/grok/status/1973615121927905606 · Twitter Post
• https://helpnetsecurity.com/2023/07/17/cve-2023-34192 · Note
• https://openwall.com/lists/oss-security/2023/11/17/2 · Note