Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

MEDIUM 6.1EXPLOITED (CISA KEV)CVE-2023-37580 · Published 31/07/2023 · updated 17/06/2026

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 27/07/2023. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
zimbra collaboration suite synacor	`= 8.8.15≥ 8.8.0, < 8.8.15`	`8.8.15`

Description

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

References

openwall.com/lists/oss-security/2023/11/17/2 · Mailing List
wiki.zimbra.com/wiki/Security_Center · Release Notes
wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Not Applicable
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2023-37580

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free