CVE-2025-48700

Source
https://cve.org/CVERecord?id=CVE-2025-48700
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48700.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-48700
Published
2025-06-23T15:15:27.930Z
Modified
2026-04-12T16:41:26.835013Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, specifically involving crafted tag structures and attribute values that include an @import directive and other script injection vectors. The vulnerability is triggered when a user views a crafted e-mail message in the Classic UI, requiring no additional user interaction.

References

Affected packages

Git / github.com/zimbra/zm-build

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-build
Events
Introduced
Fixed
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Database specific
{
    "versions": [
        {
            "introduced": "10.1.0"
        },
        {
            "fixed": "10.1.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p20"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p26"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p30"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p31"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p32"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p33"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p34"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p35"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p40"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p43"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p44"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p45"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p19"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p20"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p23"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p25"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p26"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p27"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p28"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p33"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p36"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p37"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p38"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p7"
        }
    ]
}
Type
GIT
Repo
https://github.com/zimbra/zm-mailbox
Events
Introduced
Fixed
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Database specific
{
    "versions": [
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.0.12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p15"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p16"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p17"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p18"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p23"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p24"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p25"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p27"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p29"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p31\\.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p36"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p37"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p39"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p41"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p46"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p16"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p17"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p18"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p22"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p24"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p24\\.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p29"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p30"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p32"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p34"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p39"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p40"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p41"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p9"
        }
    ]
}
Type
GIT
Repo
https://github.com/zimbra/zm-zcs-lib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Database specific
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p21"
        }
    ]
}

Affected versions

10.*
10.0.0-GA
10.0.1
10.0.11
10.0.2
10.0.5
10.0.6
10.0.7
10.0.8
10.0.9
10.1.0
10.1.1
8.*
8.7.10
8.7.11
8.7.6
8.7.7
8.7.9
8.8.0.beta1
8.8.10
8.8.12
8.8.15
8.8.15.U20
8.8.15.p1
8.8.15.p10
8.8.15.p11
8.8.15.p12
8.8.15.p13
8.8.15.p14
8.8.15.p15
8.8.15.p15.nysa
8.8.15.p16
8.8.15.p17
8.8.15.p18
8.8.15.p2
8.8.15.p20
8.8.15.p21
8.8.15.p23
8.8.15.p24
8.8.15.p25
8.8.15.p26
8.8.15.p27
8.8.15.p29
8.8.15.p3
8.8.15.p30
8.8.15.p31
8.8.15.p31.1
8.8.15.p32
8.8.15.p33
8.8.15.p34
8.8.15.p35
8.8.15.p36
8.8.15.p37
8.8.15.p39
8.8.15.p4
8.8.15.p40
8.8.15.p41
8.8.15.p43
8.8.15.p44
8.8.15.p45
8.8.15.p46
8.8.15.p5
8.8.15.p6
8.8.15.p7
8.8.15.p8
8.8.15.p9
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.8.7
8.8.8
8.8.9
8.8.9.p1
8.8.9.p3
9.*
9.0.0
9.0.0.U20
9.0.0.p1
9.0.0.p10
9.0.0.p11
9.0.0.p13
9.0.0.p14
9.0.0.p16
9.0.0.p17
9.0.0.p18
9.0.0.p19
9.0.0.p2
9.0.0.p20
9.0.0.p22
9.0.0.p23
9.0.0.p24
9.0.0.p24.1
9.0.0.p25
9.0.0.p26
9.0.0.p27
9.0.0.p28
9.0.0.p29
9.0.0.p3
9.0.0.p30
9.0.0.p32
9.0.0.p33
9.0.0.p34
9.0.0.p36
9.0.0.p37
9.0.0.p38
9.0.0.p39
9.0.0.p4
9.0.0.p40
9.0.0.p41
9.0.0.p5
9.0.0.p6
9.0.0.p7
9.0.0.p7.1
9.0.0.p8
9.0.0.p9

Database specific

unresolved_ranges
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p19"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p22"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p28"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p38"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p42"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p12"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p15"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p21"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p31"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p35"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p42"
            }
        ]
    }
]
vanir_signatures
[
    {
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2025-48700-2802cfab",
        "digest": {
            "length": 2910.0,
            "function_hash": "250239021129922179859369307689305685860"
        },
        "source": "https://github.com/zimbra/zm-mailbox/commit/36b0176b086d3ced0cd751ec0aca4d9869574496",
        "signature_type": "Function",
        "target": {
            "file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java",
            "function": "handle"
        }
    },
    {
        "deprecated": false,
        "signature_version": "v1",
        "id": "CVE-2025-48700-8d17d1e8",
        "digest": {
            "line_hashes": [
                "100352541356968744543459554936932541435",
                "34980778564753151690669805825885263298",
                "163615395104885010895005793672519100036",
                "324766885195200298088869019113793247780"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/zimbra/zm-mailbox/commit/36b0176b086d3ced0cd751ec0aca4d9869574496",
        "signature_type": "Line",
        "target": {
            "file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java"
        }
    }
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-48700.json"
vanir_signatures_modified
"2026-04-12T16:41:26Z"