An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.
References
| Link | Resource |
|---|---|
| https://wiki.zimbra.com/wiki/Security_Center | Release Notes |
| https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes | Release Notes |
| https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes | Release Notes |
| https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes | Release Notes |
| https://strikeready.com/blog/0day-ics-attack-in-the-wild/ | Exploit Third Party Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915 | US Government Resource |
Configurations
Configuration 1 (hide)
|
History
04 Nov 2025, 16:45
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915 - US Government Resource | |
| CPE | cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p39:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p41:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p42:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p28:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p40:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p43:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p29:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:* |
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p35:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p31:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p43:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p42:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p41:*:*:*:*:*:* cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:* |
| First Time |
Synacor
Synacor zimbra Collaboration Suite |
Information
Published : 2025-03-12 15:15
Updated : 2025-11-04 16:45
NVD link : CVE-2025-27915
Mitre link : CVE-2025-27915
CVE.ORG link : CVE-2025-27915
JSON object : View
Products Affected
synacor
- zimbra_collaboration_suite
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')