CVE-2025-27915
CVSS 3.1 Score 5.4 of 10 (medium)
Details
Published Mar 12, 2025
Updated: Apr 2, 2025
CWE ID 79
Summary
CVE-2025-27915 is a stored cross-site scripting (XSS) vulnerability affecting Zimbra Collaboration (ZCS) versions 9.0, 10.0, and 10.1. The Classic Web Client fails to adequately sanitize HTML content in ICS files. Malicious ICS entries, when viewed in an email message, trigger the execution of embedded JavaScript through an ontoggle event within a <details> tag. This enables attackers to run arbitrary code in the victim's session, potentially leading to unauthorized actions like email redirection and data exfiltration.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Zimbra Collaboration Suite
Affected Vendors
- Zimbra