Patchfirst
Patchfirst
CVE-2022-27926 KEVPublic exploit Medium · 6.1 EPSS 17.6%

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS)

Summary

A reflected cross-site scripting flaw exists in the /public/launchNewWindow.jsp component of Synacor's Zimbra Collaboration Suite (ZCS) 9.0. An unauthenticated attacker can execute arbitrary web script or HTML through request parameters, and the attack requires a user to interact with a crafted link or page.

Official description · NVD

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

Breakdown
67.6 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 11 months after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidence+11 mo
  3. Added to CISA KEVEU database agrees+11 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Drive-by Compromise T1189 Medium
AI mapping from the description · how it is exploited

Victim visits crafted link; drive-by script delivery

reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component
From the official description (NVD) Original (opens in a new tab) ↗

ExecutionTA0002

JavaScript T1059.007 Medium
AI mapping from the description · primary impact

Injected JavaScript executes in victim's browser

allows unauthenticated attackers to execute arbitrary web script or HTML
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 32 general rules for its techniques

Rules for this CVE

0 that reference CVE-2022-27926 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Drive-by CompromiseT11893 general rules
JavaScriptT1059.00729 general rules
All 29 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportESET

Reports are matched by finding the exact id CVE-2022-27926 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

References

4 links, grouped by NVD tag (3 duplicates merged)

Vendor Advisory 3

wiki.zimbra.com/wiki/Security_Centerwiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24wiki.zimbra.com/wiki/Zimbra_Security_Advisories

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27926
↑ ↓ chooseEnter openEsc close