Attacker Value
Very High
CVE-2023-37580
CVE-2023-37580
(Last updated October 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
Add Assessment
1
Technical Analysis
Per Google’s Threat Analysis Group (TAG), this bug was exploited as a zero-day and has been used by at least four different threat actors to “steal email data, user credentials, and authentication tokens.” Threat campaigns have targeted Greece, Moldova, Tunisia, Vietnam, and Pakistan.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
6.1 Medium
Impact Score:
2.7
Exploitability Score:
2.8
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Changed
Confidentiality (C):
Low
Integrity (I):
Low
Availability (A):
None
General Information
Vendors
- zimbra
Products
- zimbra,
- zimbra 8.8.15
References
