DaystoPatch

Zimbra (Synacor)Exploited incident

Zimbra 8.8.15 cross-site scripting in /h/autoSaveDraft (CVE-2023-34192)

CVE-2023-34192Critical, CVSS 9.0In CISA's Known Exploited Vulnerabilities catalog since 25 Feb 2025

  • Exploited after a fix existed
FixedFixed for every supported version on the day it became public.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
same day
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 8.8.15 Patch 40 was released on Tue May 30 2023.

    Coordinated disclosure (reporter 'Skay, Noah-Lab' per Zimbra's table); the patch release was the first public information. CVE record published 2023-07-06.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    CVE.org record CVE-2023-34192ClaimedQuote verified6 Jul 2023, 00:00 UTC

    Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:25a8cf8dcf2e22e4…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2023-34192)ClaimedQuote verified25 Feb 2025

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    Added to CISA's KEV catalog on 2025-02-25.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet25 Feb 2025, 20:54 UTC

    CVE-2023-34192 Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 8.8.15 Patch 40 was released on Tue May 30 2023.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    A possible Cross-site Scripting (XSS) security vulnerability has been fixed CVE-2023-34192

    First item in the 8.8.15 Patch 40 entry ('ZCS 8.8.15 Patch 40 was released on Tue May 30 2023.'). wiki.zimbra.com was in maintenance on 2026-10-22, so a Wayback capture is cited.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 8.8.15 Patch 40 was released on Tue May 30 2023.

    Zimbra's advisories table lists only 8.8.15 Patch 40 as the fix (the CVE record names only 8.8.15); the same-day 9.0.0 Patch 33 entry does not list this CVE.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Zimbra Collaboration Suite 8.8.15 before Patch 40
How we built this timeline

Fixed 30 May 2023, KEV-listed 25 Feb 2025. No public report of exploitation before the patch was found.

Severity uses Zimbra's own score from its advisories table (CVSS 9.0, Zimbra rating 'High'); the CISA-ADP score is also 9.0. Whether 9.0.x was affected is not stated;

Zimbra lists only 8.8.15.

Related

No related incidents.

Zimbra (Synacor) report card