CVE-2025-27915

Katalog CVE

CVSS 5.4 · Medium KEV · sudah dieksploitasi EPSS 4,1%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada synacor zimbra collaboration suite. Skor CVSS 3.1 5.4 (Medium) menurut CISA ADP. Masuk katalog KEV CISA pada 7 Oktober 2025, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an e-mail message containing a malicious ICS entry, its embedded JavaScript executes via an ontoggle event inside a <details> tag. This allows an attacker to run arbitrary JavaScript within the victim's session, potentially leading to unauthorized actions such as setting e-mail filters to redirect messages to an attacker-controlled address. As a result, an attacker can perform unauthorized actions on the victim's account, including e-mail redirection and data exfiltration.

Rincian

Terbit di NVD

12 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

4,1% peluang dieksploitasi; lebih tinggi dari 90,4% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting Vulnerability

Masuk KEV

7 Oktober 2025

Tenggat CISA

28 Oktober 2025 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-27915 pemerintah AS
• https://strikeready.com/blog/0day-ics-attack-in-the-wild/ exploit · advisory pihak ketiga
• https://wiki.zimbra.com/wiki/Security_Center release notes
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.13#Security_Fixes release notes
• https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.5#Security_Fixes release notes
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P44#Security_Fixes release notes