QID 150675

Date Published: 2023-05-10

QID 150675: Zimbra Cross-Site Scripting (XSS) vulnerability (CVE-2022-27926)

Zimbra Collaboration, formerly known as the Zimbra Collaboration Suite before 2019, is a collaborative software suite that includes an email server and a web client.

A reflected cross-site scripting (XSS) vulnerability in the "/public/launchNewWindow.jsp" component of Zimbra Collaboration allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

Affected Product:
Zimbra Collaboration 9.0.0

QID Detection Logic (Unauthenticated):
This QID sends a HTTP GET request and tries to access "ZmSettings.js, Startup1_2_all.js, NewWindow_2_all.js" to check vulnerable version of Zimbra Collaboration running on the target system.

NOTE: This remote check doesn't confirm the patch version. Hence, customers are advised to manually verify the patch version.

Successful exploitation could allow an attacker to execute arbitrary JavaScript code in the context of the interface or allow the attacker to access sensitive, browser-based information.

When targeted with an exploit, the URLs contains a JavaScript snippet that will download a second-stage payload to launch a Cross-Site Request Forgery (CSRF) attack to steal Zimbra users' credentials and CSRF tokens.

  • CVSS V3 rated as High - 6.1 severity.
  • CVSS V2 rated as Medium - 4.3 severity.
    • Solution
    Customers are advised to upgrade to latest version of Zimbra to remediate this vulnerability. For more information regarding this vulnerability please refer Zimbra Release.
    Vendor References

    CVEs related to QID 150675

    CVE-2022-27926 |
    Software Advisories
    Advisory ID Software Component Link
    Zimbra Release URL Logo wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24#Fixed_Issues
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].