Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI.

CISA ADP · SSVC 2.0.3

Exploitation

None

Automatable

Yes

Technical impact

Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

• — Vendor— Affected all versions Fixed in — No fix listed CNA

No fixed version listed by the sources yet.

1. 2026-10-02 Threatist record created from CVE-2023-50808
2. 2026-10-03 Alias added: GHSA-4p3v-h475-6j2m

• TI-2024-18266 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. KEVCVSS 3.1MEDIUM 6.1
• TI-2024-30553 An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before… CVSS 3.1HIGH 8.8
• TI-2022-13998 Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly… CVSS 3.1CRITICAL 9.8
• TI-2023-13772 An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute… CVSS 3.1CRITICAL 9.8
• TI-2023-13771 An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to… CVSS 3.1CRITICAL 9.8
• TI-2021-14103 An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra… CVSS 3.1CRITICAL 9.8

• CVE-2023-50808 · CVE Program
• CVE-2023-50808 · NVD
• FIRST EPSS
• GHSA-4p3v-h475-6j2m · GitHub Advisory Database · CC BY 4.0

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences