Patchfirst
Patchfirst
CVE-2022-27926 KEVPublic exploit Medium · 6.1 EPSS 17.6%

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Synacor · Zimbra Collaboration Suite (ZCS)

Summary

A reflected cross-site scripting flaw exists in the /public/launchNewWindow.jsp component of Synacor's Zimbra Collaboration Suite (ZCS) 9.0. An unauthenticated attacker can execute arbitrary web script or HTML through request parameters, and the attack requires a user to interact with a crafted link or page.

Official description · NVD

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

Breakdown
70.6 / 100
Exploited
Yes, in CISA KEV
Reports
1
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 11 months after disclosure.

  1. Disclosedday 0
  2. First seen exploitedVulnCheck KEV evidence+11 mo
  3. Added to CISA KEVEU database agrees+11 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Drive-by Compromise T1189 Medium
AI mapping from the description · how it is exploited

Victim visits crafted link; drive-by script delivery

reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component
From the official description (NVD) Original (opens in a new tab) ↗

ExecutionTA0002

JavaScript T1059.007 Medium
AI mapping from the description · primary impact

Injected JavaScript executes in victim's browser

allows unauthenticated attackers to execute arbitrary web script or HTML
From the official description (NVD) Original (opens in a new tab) ↗

Detection

0 rules for this CVE · 32 general rules for its techniques

Rules for this CVE

0 that reference CVE-2022-27926 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Drive-by CompromiseT11893 general rules
JavaScriptT1059.00729 general rules
All 29 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

What security researchers reported

Named in 1 threat report
1 reportESET

Reports are matched by finding the exact id CVE-2022-27926 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

4 links, grouped by NVD tag (3 duplicates merged)

Vendor Advisory 3

wiki.zimbra.com/wiki/Security_Centerwiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24wiki.zimbra.com/wiki/Zimbra_Security_Advisories

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27926
↑ ↓ chooseEnter openEsc close