CVE-2023-34192 - Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Synacor | Zimbra Collaboration Suite (ZCS)

• Date Added:
• 2025-02-25

• Due Date:
• 2025-03-18

Vulnerability Name

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Description

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://nvd.nist.gov/vuln/detail/CVE-2023-34192

Latest Security News

Have I Been Pwned adds 284M accounts stolen by infostealer malware

Firefox continues Manifest V2 support as Chrome disables MV2 ad-blockers

Microsoft fixes Entra ID authentication issue caused by DNS change

GitVenom attacks abuse hundreds of GitHub repos to steal crypto

Windows 10 KB5052077 update fixes broken SSH connections

New Auto-Color Linux backdoor targets North American govts, universities

US drug testing firm DISA says data breach impacts 3.3 million people

LightSpy Expands to 100+ Commands, Increasing Control Over Windows, macOS, Linux, and Mobile

Common Alerts

MediumProxy Disclosure

InformationalCross Site Scripting (Persistent) - Prime

InformationalContent-Type Header Missing

LowPermissions Policy Header Not Set

HighXML External Entity Attack

LowServer Leaks Version Information via "Server" HTTP Response Header Field

MediumCross-Domain Misconfiguration

LowX-Content-Type-Options Header Missing

HighText4shell (CVE-2022-42889)

HighOut of Band XSS

Top CVE List

CVE-2025-0111 Palo Alto Networks PAN-OS File Read Vulnerability

CVE-2024-41710 Mitel SIP Phones Argument Injection Vulnerability

CVE-2024-20953 Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability

CVE-2025-0108 Palo Alto Networks PAN-OS Authentication Bypass Vulnerability

CVE-2025-24989 Microsoft Power Pages Improper Access Control Vulnerability

CVE-2017-3881 Cisco IOS and IOS XE Remote Code Execution Vulnerability

CVE-2017-6736 Cisco IOS and IOS XE Software SNMP Remote Code Execution Vulnerability

CVE-2025-21418 Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability

CVE-2024-40891 Zyxel DSL CPE OS Command Injection Vulnerability

CVE-2017-0148 Microsoft SMBv1 Server Remote Code Execution Vulnerability

Top CWE List

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

CWE-693 Protection Mechanism Failure

CWE-201 Insertion of Sensitive Information Into Sent Data

CWE-581 Object Model Violation: Just One of Equals and Hashcode Defined

CWE-1426 Improper Validation of Generative AI Output

HighCWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-1021 Improper Restriction of Rendered UI Layers or Frames

CWE-1193 Power-On of Untrusted Execution Core Before Enabling Fabric Access Control

CWE-125 Out-of-bounds Read

CWE-1298 Hardware Logic Contains Race Conditions