We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoint, allowing authenticated attackers to inject and execute arbitrary JavaScript in a victim's session. Exploitation requires a valid auth token and involves a crafted URL with manipulated query parameters that triggers XSS when accessed by a victim.
Reserved 2025-03-10 | Published 2025-03-12 | Updated 2025-03-12 | Assigner mitrewiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11
Support options
