Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2023-34192
CVE-2023-34192:
Zimbra Collaboration Server vulnerability analysis and mitigation
Overview
A critical cross-site scripting (XSS) vulnerability (CVE-2023-34192) was discovered in Zimbra Collaboration Suite (ZCS) version 8.8.15. The vulnerability allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function (NVD, Zimbra Security).
Technical details
The vulnerability has been assigned a CVSS v3.1 base score of 9.0 CRITICAL with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).
Impact
When successfully exploited, this vulnerability allows authenticated attackers to execute arbitrary code, potentially leading to complete compromise of the affected system. The high CVSS score indicates severe potential impacts on confidentiality, integrity, and availability of the system (NVD).
Mitigation and workarounds
The vulnerability has been fixed in Zimbra ZCS 8.8.15 Patch 40. Organizations are strongly advised to apply the patch immediately. CISA has set a remediation deadline of March 18, 2025, for federal agencies to apply the fix (CISA Alert, Zimbra Security).
Community reactions
Security researchers have highlighted the critical nature of this vulnerability, particularly due to its active exploitation in the wild. The vulnerability was discovered by Skay and Noah-Lab, demonstrating the ongoing security research efforts in identifying critical vulnerabilities in widely-used collaboration platforms (Help Net Security).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management