CVE-2023-37580

2023-07-3100:00:00

attackerkb.com

zimbra collaboration

8.8.15 patch 41

xss

zero-day

threat actors

email data

credentials

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.4

Confidence

High

EPSS

0.304

Percentile

97.0%

JSON

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

Recent assessments:

ccondon-r7 at January 28, 2024 7:36pm UTC reported:

Per Google’s Threat Analysis Group (TAG), this bug was exploited as a zero-day and has been used by at least four different threat actors to “steal email data, user credentials, and authentication tokens.” Threat campaigns have targeted Greece, Moldova, Tunisia, Vietnam, and Pakistan.

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 0