Critical Zimbra Vulnerability Allows Code Execution Through Emails

Zimbra has notified users of a critical vulnerability affecting the Classic Web Client and strongly recommends installing the relevant updates.

The nature of the problem

The vulnerability is classified as a stored cross-site scripting (stored XSS) attack. It allows attackers to create specially crafted emails that, when opened, can execute malicious scripts within the user's session.

This could potentially lead to arbitrary code execution in the context of the victim's account, which makes the vulnerability critical from a security standpoint.

Fix status

As of now, the vulnerability has not yet been assigned a CVE identifier. Zimbra has already released updates that address the issue and recommends that all customers using the Classic Web Client install them as soon as possible.

The company has not yet publicly disclosed details about the specific versions affected by the vulnerability or the technical details of exploitation, limiting itself to a general description of the nature of the threat.

Recommendations

Administrators of Zimbra-based mail servers should make it a priority to check the version of the platform in use and apply the available patches. Given that the attack is carried out through ordinary emails, particular attention should be paid to the timeliness of updates, since exploitation does not require complex conditions — it is enough for a user to open a malicious message in the Classic Web Client interface.

Source: The Hacker News