===================================================================                               CERT-Renater

                    Note d'Information No. 2023/VULN246

_____________________________________________________________________

DATE                : 17/07/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Zimbra versions prior to Zimbra 
Collaboration Suite Version 8.8.15

====================================================================https://blog.zimbra.com/2023/07/security-update-for-zimbra-collaboration-suite-version-8-8-15/
_____________________________________________________________________


An XSS vulnerability in Zimbra Collaboration Suite Version 8.8.15 that 
could potentially impact the confidentiality and integrity of your data 
has surfaced. We take this matter very seriously and have already taken 
immediate action to address the issue.

Important: This vulnerability has been actively exploited, making it 
imperative to take immediate action. We strongly recommend following the 
provided mitigation steps without delay.



Issue Fixed

The issue has been fixed through input sanitization. We have also 
performed rigorous testing to ensure the effectiveness and stability of 
the system. The fix is planned to be delivered in the July patch release.



Take Action. Apply Fix Manually

We understand that you may want to take action sooner rather than later 
to protect your data.

To maintain the highest level of security, we kindly request your 
cooperation to apply the fix manually on all of your mailbox nodes.



Steps to apply the fix manually on all of your mailbox nodes

Take a backup of the file /opt/zimbra/jetty/webapps/zimbra/m/momoveto
Edit this file and go to line number 40
Update the parameter value as below
<input name="st" type="hidden" value="${fn:escapeXml(param.st)}"/>
Before the update, the line appeared as below
<input name="st" type="hidden" value="${param.st}"/>


After the update, the line should appear as below

<input name="st" type="hidden" value="${fn:escapeXml(param.st)}"/>


Note: Zimbra service restart is not required so you can do it without 
any downtime.

We apologize for any inconvenience this may cause, and we thank you for 
your understanding.

Zimbra is committed to providing you with the highest level of security, 
and we will continue to work diligently to protect your data.


========================================================+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
===================================================3D=3D=3D=3D=3D=3D=3D=