Zimbra Collaboration Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in Zimbra Collaboration (ZCS) versions 9.0, 10.0, and 10.1. This vulnerability exists in the /h/rest endpoint, where authenticated attackers can inject and execute arbitrary JavaScript in the context of a victim's session. Exploitation requires a valid authentication token and involves crafting a URL with manipulated query parameters that trigger the XSS when accessed by the victim.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's session.