CVE-2023-34192 - PatchNow

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: USER_INTERACTION

CVE Published: 2023-07-06

Added to CISA KEV: 2025-02-25 600 DAYS BETWEEN CVE AND KEV

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately update Zimbra Collaboration Suite to version newer than 8.8.15
Monitor web application logs for suspicious script injection attempts targeting /h/autoSaveDraft
Implement Content Security Policy (CSP) headers to mitigate XSS attacks
Review user account activity for signs of session compromise
HIGH patch priority due to CISA KEV listing and active exploitation

CVE-2023-34192 is a critical Cross-Site Scripting (XSS) vulnerability affecting Zimbra Collaboration Suite (ZCS) version 8.8.15 ^[1] ^[4].

Attack Method: The vulnerability allows a remote, authenticated attacker to inject malicious scripts into the application, specifically via the `/h/autoSaveDraft` function ^[1] ^[3].
Exploitation Requirements: It requires the attacker to be authenticated ^[1].
Impact: Successful exploitation allows the execution of arbitrary script code in the victim's browser ^[2]. While some sources note it can potentially lead to arbitrary code execution, this is typically a consequence of the XSS context rather than a direct remote code execution vulnerability ^[1] ^[3].

Active Exploitation: There is no widely publicized information confirming active exploitation in the wild by specific threat actors or its use in ransomware campaigns.
Proof-of-Concept (PoC): Detection templates, such as those from the Nuclei project, are available to identify vulnerable instances ^[2].

Status: Users of Zimbra Collaboration Suite 8.8.15 should consult official Zimbra security advisories for the specific patch or update that addresses this vulnerability. Organizations should prioritize patching given the high CVSS score.

CVE-2023-34192 Detail - NVD
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script. ... Secure .gov websites use HTTPS A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, s…
CVE-2023-34192.yaml - nuclei-templates - GitHub
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the victim's browser, leading to ...
PostgreSQL & Zimbra: Vendor Risk Deep Dive
CVE-2023-34192 is a critical Cross-Site Scripting (XSS) vulnerability affecting Zimbra Collaboration Suite (ZCS) version 8.8.15. This flaw allows remote, authenticated attackers to inject malicious scripts via the /h/autoSaveDraft function, potentially leading to arbitrary code execution. The vulner…
CVE-2023-34192: Zimbra Collaboration Suite XSS Vulnerability
CVE-2023-34192 is a cross-site scripting vulnerability in Zimbra Collaboration Suite. Learn about its impact, affected versions, and mitigation methods. ... CVE-2023-34192 is a critical Cross-Site Scripting (XSS) vulnerability affecting Zimbra Collaboration Suite (ZCS) version 8.8.15. This ...

🟢 CVE-2023-34192