CVE-2023-34192 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)

Exploited in the wild Critical 9.0 Published 6 Jul 2023 Updated 21 Oct 2025

Remote authenticated attackers can execute arbitrary code via XSS in Zimbra ZCS, potentially leading to account takeover.

Exploited in the wild: Since 25 Feb 2025
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-34192?

CVE-2023-34192 is a critical cross-site scripting vulnerability in Synacor Zimbra Collaboration Suite, published on 6 Jul 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

Weakness: CWE-79

Which versions are affected by CVE-2023-34192?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2023-34192?

No fix has been published for CVE-2023-34192 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 18 Mar 2025.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-34192 being exploited?

Yes. Attackers have exploited CVE-2023-34192 in the wild since at least 25 Feb 2025.

Public exploit code: 1 Nuclei template.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-77v2-mcx8-5hqm.