CVE-2025-48700
Estado: AnalizadaMedia (6.1)⚠ Explotación activa
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Puntuación base: 6.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.71%
- Percentil entre todas las CVEs puntuadas: 77
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
CISA KEV — explotada activamente
- Añadida al catálogo: 20/4/2026
- Plazo de remediación: 23/4/2026
- Uso conocido en ransomware: Unknown
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1189Drive-by Compromiseinitial access95 % - Impacto principal
T1059.007JavaScriptexecution85 % - Impacto secundario
T1005Data from Local Systemcollection75 %
XSS en Zimbra Classic UI mediante sanitización insuficiente de contenido HTML en mensajes de correo (CWE-79). Vector AV:N/UI:R con interacción pasiva del usuario viendo correo malicioso (T1189 drive-by). Permite ejecución de JavaScript arbitrario en sesión (T1059.007) y acceso a datos sensibles (T10
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
CWE
- CWE-79
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-48700",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-48700",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "active"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-04-20T00:00:00+00:00"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "CHANGED",
"version": "3.1",
"baseScore": 6.1,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
},
"impactScore": 2.7,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2025-06-23T15:15:27.930",
"references": [
{
"url": "https://wiki.zimbra.com/wiki/Security_Center",
"tags": [
"Release Notes"
],
"source": "cve@mitre.org"
},
{
"url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy",
"tags": [
"Product"
],
"source": "cve@mitre.org"
},
{
"url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48700",
"tags": [
"US Government Resource"
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction."
},
{
"lang": "es",
"value": "Se descubrió un problema en Zimbra Collaboration (ZCS) 8.8.15, 9.0, 10.0 y 10.1. Una vulnerabilidad de cross-site scripting (XSS) en la interfaz clásica de Zimbra permite a los atacantes ejecutar código JavaScript arbitrario dentro de la sesión del usuario, lo que podría provocar acceso no autorizado a información confidencial. Este problema se debe a una limpieza insuficiente del contenido HTML, en particular a estructuras de etiquetas y valores de atributos manipulados que incluyen la directiva @import y otros vectores de inyección de scripts. La vulnerabilidad se activa cuando un usuario visualiza un mensaje de correo electrónico manipulado en la interfaz clásica, sin necesidad de interacción adicional."
}
],
"lastModified": "2026-06-17T09:30:11.837",
"cisaActionDue": "2026-04-23",
"cisaExploitAdd": "2026-04-20",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E603BD7A-730E-410C-BBE1-3E5A8DD2A72F",
"versionEndExcluding": "10.0.12",
"versionStartIncluding": "10.0.0"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "55361360-9F77-4731-82AD-82E65E4C5AA0",
"versionEndExcluding": "10.1.4",
"versionStartIncluding": "10.1.0"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E39A855-C0EB-4448-AE96-177757C40C66"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FFE7BE6E-7A9A-40C7-B236-7A21103E9F41"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5924FFC-BA19-48B3-BF4D-0C2DB3FCD407"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7822D273-C2CB-4EFE-B929-3D34C65E005E"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F81528E8-FE3A-4C48-A747-34A3FF28BCAB"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D772D4BA-9ED6-492C-A0D3-0AF4F3D49037"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C2A468FE-B59B-4CE9-B9B2-C836EEAFA3E8"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "04BECDE0-F082-49FB-ACA2-5C808902AA17"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "56558FD4-4391-4199-BA6B-B53F5DC30144"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "69A530D3-B84E-427B-BC92-64BBFEF331BE"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C0DCE7F-85A4-44C6-88C8-380B0BBBFA7E"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "180AF8B6-55AE-460C-B613-37FB697B5325"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6FCB5528-70FD-4525-A78B-D5537609331A"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "34B07279-A26A-4EB1-8B33-885AD854018B"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "97402ADA-AB05-4A92-920D-EA5363424FDF"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "697A1D34-FF0C-4F9E-8E91-34404A366D70"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9030D096-87A1-4AFF-BB7C-CE71990005B3"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F211A8B1-E33E-49BE-9C18-31B1902EB4FE"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4152CEA2-9DC1-4567-BAB3-9C36F74F77EA"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9BC02B35-7FC4-41AB-8D2E-2CD1896D84C6"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0294CB8B-B0AF-4A5C-B6B2-33F5BFFFBD4C"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "968A75B4-6D23-4B83-A8B5-777D8F151E04"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E11BC24-56A3-4CAB-B0B2-D2430CD80767"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF2EE32D-04A5-46EA-92F0-3C8D74A4B82A"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50FB0099-0495-4735-9398-7F7E657F459B"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FAE2858A-6D9E-4D79-AFA6-69C44D6D8C75"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5C1D9EB8-E3FE-4BF3-8517-603BA4B126C2"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "50A296BC-6DA4-41B2-923A-0633566AD6C1"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C066ED38-1175-48FB-BE05-BE0C19E9EBE7"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p34:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "89B3EF32-B474-44DB-AE30-CD308CDC5A77"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p35:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9ECCB00-F3F4-4EB7-9FD0-4CB64678B129"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p36:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "37739F7A-490F-42A8-B97D-D09A3EDB85DC"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p37:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "518662DA-C0F3-4875-86D7-5ED2B2496CC8"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p38:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "64B28BE5-F35D-4AB0-A321-CEAE21BC26FF"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p39:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DFBABD6-70F2-4E3B-A9C0-82DE76D48542"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB3C28CA-4C22-423E-B1C7-CBAFBB91F4DB"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p40:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D2D6DBD-560A-4F8E-B2CC-67A564C460A3"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p41:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BFBC20F8-7F50-4D9D-8442-3397DED4B18B"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p42:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D175FCA2-F902-4470-BFF6-5EC2F31BB06D"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p43:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5516ED19-5648-4BC8-A9C2-6EE41B1794C7"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p44:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "28D5F229-EE33-42C4-A26D-23BC760720A5"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p45:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A00BE897-F462-4193-BF51-4381B04C076B"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p46:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8D93DABB-4E8B-4DB4-BCD5-D495933D0223"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9A1314A-20C8-42D7-9387-D914999EEAF6"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CEF091C5-8DC6-4A41-9E84-F53BE703F71B"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACD65C28-9716-4073-8613-C4AF12684760"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C58AFFF-848F-490D-A95C-03A267C2DC98"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B62DC188-89A8-4AEA-90AE-563F0BBEFC54"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32AFCE22-5ADA-4FF7-A165-5EC12B325DEF"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D3577FE6-F1F4-4555-8D27-84D6DE731EA3"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "931BD98E-1A5F-4634-945B-BDD7D2FAA8B0"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E7C0A57-A887-4D29-B601-4275313F46B3"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7248B91-D136-4DD5-A631-737E4C220A02"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "494F6FD4-36ED-4E40-8336-7F077FA80FA8"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DF8C0CE-A71D-4BB1-83FB-1EA5ED77E0C9"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0648498-2EE5-4B68-8360-ED5914285356"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24282FF8-548B-415B-95CA-1EFD404D21D3"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACFDF2D9-ED72-4969-AA3B-E8D48CB1922D"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B7D0A8B-7A72-4C1A-85F2-BE336CA47E0B"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "019AFC34-289E-4A01-B08B-A5807F7F909A"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E7B3976-DA6F-4285-93E6-2328006F7F4D"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "062E586F-0E02-45A6-93AD-895048FC2D4C"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3EE37BEE-4BDB-4E62-8DE3-98CF74DFBE01"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ADF51BCA-37DD-4642-B201-74A6D1A545FF"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39611F3D-A898-4C35-8915-3334CDFB78E5"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40AB56B7-7222-4C44-A271-45DFE3673F72"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2AE8F501-4528-4F15-AE50-D4F11FB462DE"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AB9E054B-7790-4E74-A771-40BF6EC71610"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD924E57-C77B-430B-A615-537BB39CEA9C"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F43F4AC0-7C82-4CF4-B0C7-3A4C567BC985"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7991F602-41D7-4377-B888-D66A467EAD67"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2193FCA2-1AE3-497D-B0ED-5B89727410E3"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA310AFA-492D-4A6C-A7F6-740E82CB6E57"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FF95618B-0BFB-403C-83BE-C97879FC866D"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p31:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A82346A9-9CC2-4B91-BA2F-A815AAA92A7F"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E800348-E139-418D-910B-7B3A9E1E721C"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7DE1A7E-573B-42F3-B0A4-D2E676954FE0"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E60BC1D0-8552-4E6B-B2C5-96038448C238"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p35:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3924251E-13B0-420E-8080-D3312C3D54AF"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AEBE75F9-A494-4C78-927A-EA564BDCCE0B"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "900BECBA-7FDB-4E35-9603-29706FB87BD2"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5024FD58-A3ED-43B1-83EF-F4570C2573BA"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3CC9D046-4EB4-4608-8AB7-B60AC330A770"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2AF337B5-B296-449B-8848-7636EC7C46C5"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A4535EC5-74D5-41E8-95F1-5C033ADB043E"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p41:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "408E1BFD-16AA-458C-B040-04870522FEBD"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p42:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "205B2CDC-6423-4FD9-9FD0-847ADEB64003"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "52232ACA-C158-48C8-A0DB-7689040CB8FB"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B4D0040-86D0-46C3-8A9A-3DD12138B9ED"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2BB9BC7-078D-4E08-88E4-9432D74CA9BA"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F04D4B77-D386-4BC8-8169-9846693F6F11"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "992370FA-F171-4FB3-9C1C-58AC37038CE4"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org",
"cisaRequiredAction": "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.",
"cisaVulnerabilityName": "Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability"
}