Reflected Cross-Site Scripting Vulnerability in Zimbra Collaboration
CVE-2025-27914

5.4MEDIUM

Key Information:

Vendor

Zimbra

Status
Zimbra Collaboration
Vendor
CVE Published:
12 March 2025

What is CVE-2025-27914?

A Reflected Cross-Site Scripting vulnerability has been identified in Zimbra Collaboration versions 9.0, 10.0, and 10.1. This flaw is present at the /h/rest endpoint, enabling authenticated attackers to inject malicious JavaScript into user sessions through crafted URLs. Exploitation involves the use of a valid authentication token and manipulation of query parameters to trigger the vulnerability when accessed by unsuspecting victims.

References

https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosur...
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Secu...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-27914 : Reflected Cross-Site Scripting Vulnerability in Zimbra Collaboration