CVE-2022-27926

Published: Apr 21, 2022Modified: Oct 31, 2025CISA KEV

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

Affected (24)

Products: Synacor: Zimbra Collaboration Suite

Synacor

1 product

Zimbra Collaboration Suite

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Synacor Zimbra Collaboration Suite	Version 9.0.0
Synacor Zimbra Collaboration Suite	Version 9.0.0 p10
Synacor Zimbra Collaboration Suite	Version 9.0.0 p11
Synacor Zimbra Collaboration Suite	Version 9.0.0 p12
Synacor Zimbra Collaboration Suite	Version 9.0.0 p13
Synacor Zimbra Collaboration Suite	Version 9.0.0 p14
Synacor Zimbra Collaboration Suite	Version 9.0.0 p15
Synacor Zimbra Collaboration Suite	Version 9.0.0 p16
Synacor Zimbra Collaboration Suite	Version 9.0.0 p17
Synacor Zimbra Collaboration Suite	Version 9.0.0 p18
Synacor Zimbra Collaboration Suite	Version 9.0.0 p19
Synacor Zimbra Collaboration Suite	Version 9.0.0 p1
Synacor Zimbra Collaboration Suite	Version 9.0.0 p20
Synacor Zimbra Collaboration Suite	Version 9.0.0 p21
Synacor Zimbra Collaboration Suite	Version 9.0.0 p22
Synacor Zimbra Collaboration Suite	Version 9.0.0 p23
Synacor Zimbra Collaboration Suite	Version 9.0.0 p2
Synacor Zimbra Collaboration Suite	Version 9.0.0 p3
Synacor Zimbra Collaboration Suite	Version 9.0.0 p4
Synacor Zimbra Collaboration Suite	Version 9.0.0 p5
Synacor Zimbra Collaboration Suite	Version 9.0.0 p6
Synacor Zimbra Collaboration Suite	Version 9.0.0 p7
Synacor Zimbra Collaboration Suite	Version 9.0.0 p8
Synacor Zimbra Collaboration Suite	Version 9.0.0 p9