{"id":"CVE-2022-27926","aliases":["EUVD-2022-32414","GHSA-chc6-9436-6wfq"],"status":"published","title":"A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component...","description":"A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.17634,"percentile":0.97188,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-138","CWE-79"],"published":"2022-04-20T23:23:40Z","modified":"2026-10-28T02:31:15Z","kev":{"date_added":"2023-04-03","due_date":"2023-04-24","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-04-03"},{"source":"kev","since":"2023-04-03"}],"exploits":[{"source":"nuclei","id":"CVE-2022-27926","title":"Zimbra Collaboration (ZCS) - Cross Site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-27926.yaml"}],"products":[{"vendor":"synacor","product":"zimbra collaboration suite (zcs)"},{"vendor":"synacor","product":"zimbra_collaboration_suite"}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","web"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27926","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27926","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-chc6-9436-6wfq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27926.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-27926","description":"A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.","status":"published","published":"2022-04-20T23:23:40Z","modified":"2025-10-21T23:15:40.915Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:34.250357Z"}],"euvd":[{"id":"EUVD-2022-32414","description":"A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.","status":"published","published":"2022-04-20T23:23:40Z","modified":"2025-10-21T23:15:40Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"exploited_since":"2023-04-03","updated_at":"2026-11-02T20:31:26.48918Z"}],"ghsa":[{"id":"GHSA-chc6-9436-6wfq","title":"A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component...","description":"A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.","status":"published","published":"2022-04-22T00:00:38Z","modified":"2025-10-22T00:33:35Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:08.198655Z"}],"kev":[{"id":"CVE-2022-27926","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","description":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability by allowing an endpoint URL to accept parameters without sanitizing.","cwes":["CWE-79","CWE-138"],"kev":{"date_added":"2023-04-03","due_date":"2023-04-24","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2022-27926","description":"A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.","status":"published","published":"2022-04-21T00:15:08.45Z","modified":"2026-06-17T04:37:45.02Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:16.9948Z"}],"osv":[{"id":"CVE-2022-27926","description":"A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.","status":"published","published":"2022-04-20T23:23:40Z","modified":"2026-10-28T02:31:15.072479588Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:24.758293Z"}]}}