VulnerabilityBleeping Computer
6.1 — HIGH
Zimbra urges customers to patch critical web client XSS flaw
The Zimbra security team urged customers to patch a critical vulnerability affecting the Classic Web Client used to access the Zimbra Collaboration suite. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
A critical stored cross-site scripting (XSS) vulnerability in the Zimbra Classic Web Client allows attackers to steal session data, account settings, or mailbox information through specially crafted emails. This issue has been exploited by Russian state-sponsored hackers in recent years.
⚙️Technical Details
Affected Systems
Zimbra Collaboration Suite (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13, Zimbra Collaboration Suite 8.8.15 and 9.0 and 10.0 and 10.1
Attack Vectors
NETWORK
💥Impact Assessment
Severity: HIGH
Who Is at Risk
Users of the Classic Web Client in Zimbra Collaboration Suite, particularly those targeted by Russian state-sponsored hackers
🛡️Recommended Actions
1Upgrade to ZCS v10.1.19 as soon as possible
2Implement a web application firewall (WAF) to block malicious traffic
3Monitor email accounts and session data for suspicious activity
📦Affected Products
Synacor Zimbra Collaboration Suite
🔐NVD Verified DataVERIFIED
CVE-2025-66376 ↗CVSS 6.1 — MEDIUM
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWeaknesses
CWE-79
Affected Products (CPE)
Synacor Zimbra Collaboration Suite
CVE-2025-48700 ↗CVSS 6.1 — MEDIUM
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NWeaknesses
CWE-79
Affected Products (CPE)
Synacor Zimbra Collaboration Suite
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.