{"id":"CVE-2022-27926","details":"A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration (aka ZCS) 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters.","modified":"2026-09-14T03:45:19.010419543Z","published":"2022-04-20T23:23:40Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27926.json"},"references":[{"type":"WEB","url":"https://wiki.zimbra.com/wiki/Security_Center"},{"type":"WEB","url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24"},{"type":"WEB","url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27926"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/27xxx/CVE-2022-27926.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27926"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-build","events":[{"introduced":"b6cd8f69d2761c014d4a3807f0bdee0011386444"},{"last_affected":"bcb978ccc354d99d843725886083e321759b6765"}],"database_specific":{"extracted_events":[{"introduced":"9.0.0-NA"},{"last_affected":"9.0.0-NA"},{"introduced":"9.0.0-p1"},{"last_affected":"9.0.0-p1"},{"introduced":"9.0.0-p19"},{"last_affected":"9.0.0-p19"},{"introduced":"9.0.0-p20"},{"last_affected":"9.0.0-p20"},{"introduced":"9.0.0-p23"},{"last_affected":"9.0.0-p23"},{"introduced":"9.0.0-p4"},{"last_affected":"9.0.0-p4"},{"introduced":"9.0.0-p7"},{"last_affected":"9.0.0-p7"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*"]}}],"versions":["9.0.0-NA","9.0.0-p1","9.0.0-p20","9.0.0-p23","9.0.0-p4","9.0.0-p7","9.0.0","9.0.0.p7","9.0.0.p4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-27926.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-mailbox","events":[{"introduced":"2ec276e0cd140c34d2e8aa6e2260a10901e43a9d"},{"last_affected":"10b7ff251aee6f4770ad75377a1f81491ad5bdb9"}],"database_specific":{"cpe":["cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0.0-NA"},{"last_affected":"9.0.0-NA"},{"introduced":"9.0.0-p1"},{"last_affected":"9.0.0-p1"},{"introduced":"9.0.0-p10"},{"last_affected":"9.0.0-p10"},{"introduced":"9.0.0-p11"},{"last_affected":"9.0.0-p11"},{"introduced":"9.0.0-p13"},{"last_affected":"9.0.0-p13"},{"introduced":"9.0.0-p14"},{"last_affected":"9.0.0-p14"},{"introduced":"9.0.0-p16"},{"last_affected":"9.0.0-p16"},{"introduced":"9.0.0-p17"},{"last_affected":"9.0.0-p17"},{"introduced":"9.0.0-p18"},{"last_affected":"9.0.0-p18"},{"introduced":"9.0.0-p19"},{"last_affected":"9.0.0-p19"},{"introduced":"9.0.0-p2"},{"last_affected":"9.0.0-p2"},{"introduced":"9.0.0-p20"},{"last_affected":"9.0.0-p20"},{"introduced":"9.0.0-p22"},{"last_affected":"9.0.0-p22"},{"introduced":"9.0.0-p23"},{"last_affected":"9.0.0-p23"},{"introduced":"9.0.0-p3"},{"last_affected":"9.0.0-p3"},{"introduced":"9.0.0-p4"},{"last_affected":"9.0.0-p4"},{"introduced":"9.0.0-p5"},{"last_affected":"9.0.0-p5"},{"introduced":"9.0.0-p6"},{"last_affected":"9.0.0-p6"},{"introduced":"9.0.0-p7"},{"last_affected":"9.0.0-p7"},{"introduced":"9.0.0-p8"},{"last_affected":"9.0.0-p8"},{"introduced":"9.0.0-p9"},{"last_affected":"9.0.0-p9"}],"source":"CPE_STRING"}}],"versions":["9.0.0-NA","9.0.0-p1","9.0.0-p10","9.0.0-p11","9.0.0-p13","9.0.0-p16","9.0.0-p17","9.0.0-p18","9.0.0-p19","9.0.0-p2","9.0.0-p20","9.0.0-p22","9.0.0-p23","9.0.0-p3","9.0.0-p4","9.0.0-p5","9.0.0-p6","9.0.0-p7","9.0.0-p8","9.0.0-p9","9.0.0","9.0.0.p9","9.0.0.p8","9.0.0.p7","9.0.0.p6","9.0.0.p5","9.0.0.p4","9.0.0.p3","9.0.0.p2","9.0.0.p1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-27926.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-zcs","events":[{"introduced":"7cf503e14f689f39bad171475fb4e151bfcc22ee"},{"last_affected":"7cf503e14f689f39bad171475fb4e151bfcc22ee"}],"database_specific":{"cpe":"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*","extracted_events":[{"introduced":"9.0.0-NA"},{"last_affected":"9.0.0-NA"}],"source":"CPE_STRING"}}],"versions":["9.0.0-NA","9.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-27926.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-zcs-lib","events":[{"introduced":"08274721e99c2522952c640cd42e4d0cf676d432"},{"last_affected":"f7d07af90e612dba63830d5f7babb18d7c512eb4"}],"database_specific":{"cpe":["cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*","cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.0.0-NA"},{"last_affected":"9.0.0-NA"},{"introduced":"9.0.0-p13"},{"last_affected":"9.0.0-p13"},{"introduced":"9.0.0-p14"},{"last_affected":"9.0.0-p14"},{"introduced":"9.0.0-p16"},{"last_affected":"9.0.0-p16"},{"introduced":"9.0.0-p17"},{"last_affected":"9.0.0-p17"},{"introduced":"9.0.0-p23"},{"last_affected":"9.0.0-p23"},{"introduced":"9.0.0-p3"},{"last_affected":"9.0.0-p3"},{"introduced":"9.0.0-p4"},{"last_affected":"9.0.0-p4"}],"source":"CPE_STRING"}}],"versions":["9.0.0-NA","9.0.0-p13","9.0.0-p14","9.0.0-p16","9.0.0-p17","9.0.0-p23","9.0.0-p3","9.0.0-p4","9.0.0","9.0.0.p4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-27926.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}