CVE-2022-27926 — VulnIntel

CVE-2022-27926

MEDIUM

KEV

A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.

StatusAnalyzed

설명

Score Summary

CVSS Score: 6.1
Version: 3.1
VPI: 91.50
Why this VPI (explainable, experimental)
VPI breakdown
Impact 61.00
Exploitation signal(KEV listed) ×1.50
VPI 91.50
VPI formula vpi-v1
EPSS: 17.6%
(상위 96.8%)
Attack Vector: Network
Low Complexity
No Privileges
User Interaction Required
Scope Changed
Low Confidentiality Impact
Low Integrity Impact
No Availability Impact

Details

Published: 04/21/2022(4 years ago)
Modified: 10/31/2025(9 months ago)
Source: KEV, NVD
Products: 1

CISA KEV Listing

Vendor / Project: Synacor
Product: Zimbra Collaboration Suite (ZCS)

Date Added: 04/03/2023
Due Date: 04/24/2023Overdue 1185d

Required Action

Apply updates per vendor instructions.

Vulnerability Lifecycle

NVDPublished04/21/2022
CISA KEVKEV Listed04/03/2023
CISA KEV

Score Comparison by Source

Source	CVSS Version	Base Score	Severity	Vector String	Assessment Date
NVDNIST	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	04/20/2026
NVDNIST	2.0	4.3

CWE Weakness Classification

CWE-79
NVD
Secondary

References (4)

NVD
Advisory
https://wiki.zimbra.com/wiki/Security_Center
NVD
Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24
NVD
Advisory

Affected Products (1)

Impact	61.00
Exploitation signal(KEV listed)	×1.50
VPI	91.50