CVE-2023-37580

Katalog CVE

CVSS 6.1 · Medium KEV · sudah dieksploitasi EPSS 49,1%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada synacor zimbra collaboration suite. Skor CVSS 3.1 6.1 (Medium) menurut NVD. Masuk katalog KEV CISA pada 27 Juli 2023, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

Rincian

Terbit di NVD

31 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

49,1% peluang dieksploitasi; lebih tinggi dari 98,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Masuk KEV

27 Juli 2023

Tenggat CISA

17 Agustus 2023 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• http://www.openwall.com/lists/oss-security/2023/11/17/2 mailing list · patch
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-37580 pemerintah AS
• https://wiki.zimbra.com/wiki/Security_Center release notes
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy not applicable