Medium · published March 12, 2025
CVSS calls it medium at 5.4. It is confirmed in active exploitation. It sits in the 90.6th percentile for exploit probability.
⚠️ A sneaky JavaScript exploit hides inside your calendar invites! If you're using Zimbra Collaboration 9.0, 10.0, or 10.1, watch out for malicious ICS files that can trigger stored cross-site scripting (XSS). Think of it like receiving a harmless-looking party invitation that, when opened, reveals a hidden message that changes your whole agenda without your consent — secretly redirecting your plans to favor someone else. 🎉 This vulnerability could lead an attacker to take control of your email session, allowing them to set up filters that redirect your messages to their own address, or even extract sensitive data from your account. It's a bit like someone hijacking your email communication right under your nose!
Think of it like receiving a harmless-looking party invitation that, when opened, reveals a hidden message that changes your whole agenda without your consent — secretly redirecting your plans to favor someone else. 🎉 The stored XSS vulnerability arises from insufficient sanitization of HTML content in ICS files, letting malicious JavaScript execute when a user interacts with a <details> element in the email client. This can occur without any action from the user beyond just viewing the email.
This vulnerability could lead an attacker to take control of your email session, allowing them to set up filters that redirect your messages to their own address, or even extract sensitive data from your account. It's a bit like someone hijacking your email communication right under your nose! Patch your Zimbra Collaboration to version 9.0.0 and 10.1.0 immediately to mitigate this risk. In the meantime, educate users to be cautious with unexpected calendar invites, especially from unknown senders. 🛡️ You've got this! Stay proactive, and your email will be secure in no time! 🔒