CVE-2023-34192

Timeline

Detection, updates, and resolution for this record.

1. Jul 6, 2023 · Catalog

   Detected

   Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

2. Feb 25, 2025 · CISA KEV

   Known exploited

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

3. Mar 18, 2025 · CISA KEV

   Remediation due

   Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

4. Jun 16, 2026 · Catalog

   Updated

   Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

Affected

• cpe synacor/zimbra collaboration suite8.8.15
• vendor Synacor Zimbra Collaboration Suite (ZCS)version unspecified

Sources

• CISA KEVCVE-2023-34192

  Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability that allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

  cisa.gov
• CVE.orgCVE-2023-34192

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2023-34192

  30-day exploitation probability 77.3%

  first.org
• NIST NVDCVE-2023-34192

  Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

  nvd.nist.gov

References

• CISA note · nvd.nist.gov
• Release Notes · wiki.zimbra.com
• Not Applicable · wiki.zimbra.com
• CISA note · wiki.zimbra.com
• US Government Resource · cisa.gov