An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. Exploitation requires a valid auth token and involves a crafted URL with manipulated query parameters that triggers XSS when accessed by a victim.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes | Release Notes |
| https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy | Technical Description |
Configurations
Configuration 1 (hide)
|
History
02 Apr 2025, 20:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes - Release Notes | |
| References | () https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy - Technical Description | |
| CPE | cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:10.1.0:*:*:*:*:*:*:* cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:* |
|
| First Time |
Zimbra collaboration
Zimbra |
12 Mar 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-12 15:15
Updated : 2025-04-02 20:38
NVD link : CVE-2025-27914
Mitre link : CVE-2025-27914
JSON object : View
Products Affected
zimbra
- collaboration
CWE
No CWE.