CVE-2022-27926
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Description
CVE-2022-27926 is a reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration Suite (ZCS) 9.0. This flaw allows unauthenticated attackers to execute arbitrary web scripts or HTML in the context of a victim's browser session by crafting malicious request parameters. Successful exploitation of CVE-2022-27926 could enable attackers to steal session cookies, redirect users to phishing pages, or perform actions on behalf of authenticated Zimbra users. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and carries an exceptionally high EPSS score of 0.94, indicating a very strong likelihood of active exploitation in the wild. Organizations running Zimbra Collaboration Suite 9.0 should treat this cross-site scripting issue as an urgent remediation priority.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| synacor | zimbra collaboration suite | 9.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://wiki.zimbra.com/wiki/Security_Center(Vendor Advisory)
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24(Release Notes, Vendor Advisory)
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27926(US Government Resource)
Weakness Type
CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
In the context of CVE-2022-27926, the Zimbra Collaboration Suite fails to properly sanitize user-supplied input in request parameters passed to the /public/launchNewWindow.jsp endpoint. This allows an attacker to inject malicious scripts that execute within the browser of any user who clicks a crafted link, potentially compromising their Zimbra session.
Learn more: CWE-79 — Improper Neutralization of Input During Web Page Generation
Impact Analysis
CVE-2022-27926 is remotely exploitable without physical access and requires no authentication to trigger, though it does require user interaction in the form of a victim clicking a malicious link. With a CVSS score of 6.1 (MEDIUM), the vulnerability's scope is changed, meaning exploitation can affect resources beyond the vulnerable Zimbra component itself — specifically the victim's browser session and any web applications they are authenticated to. The confidentiality and integrity impacts are low individually, but in practice, a successful XSS attack against a Zimbra email user could lead to email account takeover, exposure of sensitive communications, and further phishing attacks within the organization. The EPSS score of 0.94 places this vulnerability in the 99th percentile for exploitation probability, strongly indicating that threat actors are actively leveraging this flaw in real-world campaigns against Zimbra deployments.
Exploit Maturity
Active exploitation of CVE-2022-27926 has been confirmed by CISA, which added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of April 24, 2023. The EPSS score of 0.94 (99th percentile) further corroborates that this reflected XSS vulnerability in Zimbra Collaboration Suite is being actively targeted. While no dedicated public exploit code repositories are directly referenced in the NVD entries, the simplicity of reflected XSS attacks combined with Zimbra's widespread deployment as an email platform makes weaponization straightforward for attackers with even basic capabilities.
Remediation
- Apply the vendor patch immediately — upgrade Zimbra Collaboration Suite to version 9.0.0 P24 or later, as detailed in the Zimbra 9.0.0 P24 release notes, or apply mitigations per vendor instructions. If patching is not possible, discontinue use of the product.
- Upgrade to the latest available ZCS release — Zimbra regularly publishes security patches. Review the Zimbra Security Center for the most current security advisories and ensure your deployment is running a fully patched version.
- Deploy a web application firewall (WAF) with rules to detect and block reflected XSS payloads in URL parameters, particularly targeting the /public/launchNewWindow.jsp endpoint. Implement Content Security Policy (CSP) headers to restrict inline script execution.
- Review web server and Zimbra access logs for suspicious requests to /public/launchNewWindow.jsp containing encoded script tags or unusual parameter values. Monitor for indicators of compromise such as unexpected session activity or phishing redirects originating from Zimbra URLs.
- Implement comprehensive input validation and output encoding across all Zimbra customizations and integrations. Enforce strict HTTP-only and Secure flags on session cookies to reduce the impact of any future XSS vulnerabilities.
Technical Details
CVE-2022-27926 exploits improper neutralization of input during web page generation (CWE-79) in the /public/launchNewWindow.jsp component of Zimbra Collaboration Suite 9.0. The vulnerability occurs because user-supplied request parameters are reflected directly into the HTML response without adequate sanitization or encoding, enabling an attacker to inject arbitrary JavaScript or HTML markup. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates that the attack is network-based with low complexity and requires no privileges, though victim interaction is necessary to trigger the payload. The scope is changed because the injected script executes in the victim's browser context, potentially affecting other web applications and sessions beyond the Zimbra instance itself. As a reflected XSS variant, each attack requires a uniquely crafted URL delivered to the target, typically via phishing emails or malicious links.
Frequently Asked Questions
What is CVE-2022-27926?
CVE-2022-27926 is a reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration Suite 9.0 that allows unauthenticated attackers to execute arbitrary scripts in a victim's browser by sending them a crafted URL.
How severe is CVE-2022-27926?
The vulnerability has a CVSS score of 6.1 (MEDIUM). While the direct technical impact is limited to low confidentiality and integrity compromise, the practical risk is elevated because the EPSS score of 0.94 indicates a very high probability of active exploitation, and CISA has confirmed real-world attacks.
Which versions of Zimbra are affected?
Zimbra Collaboration Suite (ZCS) version 9.0 is affected by CVE-2022-27926. Users should upgrade to version 9.0.0 P24 or later.
Has CVE-2022-27926 been exploited in the wild?
Yes. CISA added CVE-2022-27926 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. The remediation deadline was set for April 24, 2023.
What should I do to protect my Zimbra deployment?
Apply the Zimbra 9.0.0 P24 patch or upgrade to a more recent version. Additionally, deploy WAF rules to filter XSS payloads and implement Content Security Policy headers to mitigate the impact of any similar vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.