An unauthenticated stored XSS vulnerability in Zimbra Collaboration Suite (ZCS) allows attackers to execute arbitrary scripts in the context of a victim's session, leading to potential account takeover.

This is a stored cross-site scripting (CWE-79) vulnerability occurring when an unauthenticated attacker sends a calendar COUNTER message containing malicious markup in the RFC From address. When a user views this message within the Zimbra Classic interface, the script executes, granting the attacker the ability to access mailbox data and impersonate the victim.

The exploitation of this vulnerability poses a severe threat to organizational data security, as it allows unauthorized access to sensitive mailbox information and enables attackers to perform actions on behalf of authenticated users. With a CVSS score of 9.3, this flaw is categorized as critical because it facilitates full compromise of user sessions, potentially leading to widespread data exfiltration or internal phishing campaigns.

Immediate Action: Update Zimbra Collaboration Suite (ZCS) to version 10.1.21 or later to apply the necessary security patches.

Proactive Monitoring: Review web access logs for unusual patterns in calendar-related requests and monitor for anomalous script execution behavior within the Zimbra Classic web interface.

Compensating Controls: Implement strict Content Security Policy (CSP) headers to mitigate the impact of XSS attacks and deploy a Web Application Firewall (WAF) to filter malicious markup from incoming SMTP/calendar traffic.

Public Exploit Available: No

Given the critical nature of this vulnerability and the potential for full account compromise, administrators should prioritize patching their Zimbra environments immediately. Moving to version 10.1.21 is the only definitive way to neutralize the threat posed by this stored XSS vulnerability.