Zimbra Collaboration Stored Cross-Site Scripting Vulnerability via CSS @import Directives

A stored cross-site scripting vulnerability has been identified in Zimbra Collaboration (ZCS) versions 10 prior to 10.0.18 and 10.1 prior to 10.1.13. This vulnerability allows for cross-site scripting attacks in the Classic UI by exploiting Cascading Style Sheets (CSS) @import directives within HTML email messages. The issue arises from insufficient input sanitization, enabling the injection of malicious scripts that are executed when the email is viewed.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user viewing the email.

Remediation

Users can upgrade to Zimbra Collaboration 10.0.18 or 10.1.13, both of which include the necessary patch. Instructions for upgrading Zimbra can be found on the Zimbra website.