Veille CVE
CVE-2025-66376
6.1 Moyenne Exploitée activementCatalogue CISA KEV — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
Ajoutée le 18/03/2026 · Échéance de correction (agences US) : 01/04/2026
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.2 Élevée | cve@mitre.org | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
| 3.1 | 6.1 Moyenne | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Faiblesses (CWE)
Références
- https://wiki.zimbra.com/wiki/Security_Center Release NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.18#Security_Fixes Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.13#Security_Fixes Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy Product
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-66376 US Government Resource