PT-2025-11078 · Zimbra · Zimbra Collaboration

Published 2024-11-12 · Updated 2025-03-12 · CVE-2025-27914

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration (ZCS) versions 9.0 through 10.1

Description: A Reflected Cross-Site Scripting (XSS) issue exists, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. The issue is related to the "/h/rest" endpoint and involves a crafted URL with manipulated query parameters. Exploitation requires a valid auth token.

Recommendations: For Zimbra Collaboration (ZCS) versions 9.0 through 10.1, consider restricting access to the "/h/rest" endpoint until a patch is available. As a temporary workaround, avoid using manipulated query parameters in the affected endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-00275

CVE-2025-27914

Affected Products

Zimbra Collaboration

References · 7

• https://osv.dev/vulnerability/CVE-2025-27914 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00275 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-27914 · Security Note
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Note
• https://twitter.com/CVEnew/status/1899894963300950258 · Twitter Post
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Note
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes · Note