CVE-2023-37580 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)

Exploited in the wild Medium 6.1 Published 31 Jul 2023 Updated 30 Oct 2025

Cross-site scripting in Zimbra Classic Web Client allows attackers to execute scripts or hijack sessions.

Exploited in the wild: Since 27 Jul 2023
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2023-37580?

CVE-2023-37580 is a medium-severity cross-site scripting vulnerability in Synacor Zimbra Collaboration Suite, published on 31 Jul 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

Weakness: CWE-79

Which versions are affected by CVE-2023-37580?

It affects 1 product.

Products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2023-37580?

No fix has been published for CVE-2023-37580 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Aug 2023.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-37580 being exploited?

Yes. Attackers have exploited CVE-2023-37580 in the wild since at least 27 Jul 2023.

Public exploit code: 1 Nuclei template.

All Synacor Zimbra Collaboration Suite vulnerabilities

Sources

Also known as GHSA-vw6f-667c-3jv3.