CVE-2022-27926: Zimbra Collaboration (ZCS) Cross-Site Scripting (XSS) Vulnerability
First published: Wed Apr 20 2022(Updated: )
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
Credit: cve@mitre.org cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zimbra Collaboration | =9.0.0 | |
| Zimbra Collaboration (ZCS) | ||
| Roundcube email server | =1.4.14 | |
| Roundcube email server | =1.5.x before 1.5.4 | |
| Roundcube email server | =1.6.x before 1.6.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://www.bleepingcomputer.com/news/security/cisa-roundcube-email-server-bug-now-exploited-in-attacks/
- https://wiki.zimbra.com/wiki/Security_Center;
- https://nvd.nist.gov/vuln/detail/CVE-2022-27926
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2022-27926?
CVE-2022-27926 is a reflected cross-site scripting (XSS) vulnerability in Zimbra Collaboration (ZCS) 9.0 that allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.
How can this vulnerability be exploited?
This vulnerability can be exploited by sending specially crafted request parameters to the /public/launchNewWindow.jsp component of Zimbra Collaboration (ZCS) 9.0.
Who is affected by CVE-2022-27926?
Users of Zimbra Collaboration (ZCS) 9.0 are affected by this vulnerability.
What is the severity of CVE-2022-27926?
CVE-2022-27926 has a severity rating of medium.
How can I mitigate CVE-2022-27926?
To mitigate this vulnerability, it is recommended to update Zimbra Collaboration to a patched version.
- collector/nvd-api
- collector/nvd-index
- agent/type
- agent/title
- agent/weakness
- agent/description
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2023-43770
- alias/CVE-2023-5631
- alias/CVE-2020-35730
- alias/CVE-2022-27926
- zeroday/true
- agent/news-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/severity
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/first-publish-date
- agent/event
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/references
- agent/author
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- agent/trending
- vendor/zimbra
- canonical/zimbra collaboration
- version/zimbra collaboration/9.0.0
- vendor/roundcube
- canonical/roundcube email server
- version/roundcube email server/1.4.14
- version/roundcube email server/1.5.x before 1.5.4
- version/roundcube email server/1.6.x before 1.6.3
- canonical/zimbra collaboration (zcs)