CVE-2023-34192

Description

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

Scoring

• CVSS: 9 (CRITICAL, 3.1)
• EPSS exploitation probability: Not yet available
• EPSS percentile: Not yet available

CISA KEV status

• Added to KEV: 2025-02-25
• Remediation due date: 2025-03-18
• Known ransomware campaign use: Unknown

Weakness types (CWE)

• CWE-79
• CWE-79

References

• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34192

More from Synacor

• CVE-2026-73570 — Zimbra Collaboration Suite (ZCS)
• CVE-2025-48700 — Zimbra Collaboration Suite (ZCS)
• CVE-2025-66376 — Zimbra Collaboration Suite (ZCS)
• CVE-2020-7796 — Zimbra Collaboration Suite
• CVE-2025-68645 — Zimbra Collaboration Suite (ZCS)