CVE-2023-37580

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
http://www.openwall.com/lists/oss-security/2023/11/17/2	Mailing List Patch
https://wiki.zimbra.com/wiki/Security_Center	Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy	Not Applicable

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zimbra:zimbra::::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p11::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p26::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p3::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p30::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p31::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p32::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p33::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p34::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p35::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p37::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p38::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p40::::::
	cpe:2.3:a:zimbra:zimbra:8.8.15:p5::::::

History

No history.

Information

Published : 2023-07-31 16:15

Updated : 2023-12-22 15:16

NVD link : CVE-2023-37580

Mitre link : CVE-2023-37580

CVE.ORG link : CVE-2023-37580

JSON object : View

Products Affected

zimbra

zimbra

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2023-37580", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2023-07-31T16:15:10.327", "references": [{"url": "http://www.openwall.com/lists/oss-security/2023/11/17/2", "tags": ["Mailing List", "Patch"], "source": "cve@mitre.org"}, {"url": "https://wiki.zimbra.com/wiki/Security_Center", "tags": ["Release Notes"], "source": "cve@mitre.org"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy", "tags": ["Not Applicable"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client."}], "lastModified": "2023-12-22T15:16:27.810", "cisaActionDue": "2023-08-17", "cisaExploitAdd": "2023-07-27", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zimbra:zimbra:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38ECDB77-75C2-4F1F-94A8-D0F7CAC58427", "versionEndExcluding": "8.8.15", "versionStartIncluding": "8.8.0"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p11:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D94082EB-9245-421E-A195-659ED7E97FBD"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p26:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F10A5925-168E-45E8-888E-E4042A1406A4"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "074B9DC0-1700-4C29-B332-093FEA785D39"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p30:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85C96088-3631-4CAE-BA6C-9E7A12EC455F"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p31:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BCB801E7-C9C5-42FC-A4C3-CECD9F21887B"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p32:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A22C14E7-34AE-438C-9E2A-DA4BF07889D5"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p33:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5251B9B-87EF-4300-A791-8C2BB2B58FA8"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p34:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9795188-0A57-48A6-B876-0A2477888D6F"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p35:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4288C356-C993-486F-B3CF-D8E44A7A53C7"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p37:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7A98258E-91BA-45F0-8417-6FFB3CF02FB5"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p38:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3EFD7BC4-0284-4551-972C-81DD7F225DA9"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p40:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACA5EA7B-95A3-49E9-A407-A034279173FB"}, {"criteria": "cpe:2.3:a:zimbra:zimbra:8.8.15:p5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9F670A63-D8E9-4360-83CF-5C5D3D8B569E"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org", "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "cisaVulnerabilityName": "Zimbra Collaboration (ZCS) Cross-Site Scripting (XSS) Vulnerability"}