CVE-2023-37580

medium

Description

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

References

Exploits
More

https://thehackernews.com/2026/07/critical-zimbra-flaw-could-let-crafted_0483473395.html

https://www.ic3.gov/Media/News/2024/241010.pdf

https://www.darkreading.com/cyberattacks-data-breaches/recent-zimbra-rce-under-attack-patch-now

https://thehackernews.com/2023/11/zero-day-flaw-in-zimbra-email-software.html

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-37580

https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy

https://wiki.zimbra.com/wiki/Security_Center

http://www.openwall.com/lists/oss-security/2023/11/17/2

Details

Source: Mitre, NVD

Published: 2023-07-31

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: Medium

EPSS

EPSS: 0.60034