Update Zimbra urgently! Google has discovered an actively exploited vulnerability in a popular email client

Company Zimbradeveloper of popular email software, warned about a critical vulnerability in their product, which is actively exploited by attackers.

“In Zimbra Collaboration Suite version 8.8.15, a vulnerability security that could potentially compromise the confidentiality and integrity of your data,” the company said in a statement.

The company also revealed that the issue has been fixed and that the fix will be included in the July update. Additional details about the vulnerability have not yet been disclosed, although Zimbra said that it solved the problem by sanitizing the input data.

As a temporary solution, the company recommends that its customers apply a manual fix to eliminate the attack vector:

• Make a backup copy of /opt/zimbra/jetty/webapps/zimbra/m/momoveto
• Edit this file and go to line number 40
• Update parameter value as:
• Before the update, the line looked like this:

While the company did not disclose details of active exploitation, Google Threat Analysis Group (TAG) researcher Maddy Stone said it had found an abuse of the vulnerability. XSS in a targeted attack. TAG researcher Clement Lesigne received a commendation for finding and reporting the bug.

The disclosure comes as Cisco released patches to address a critical vulnerability in its SD-WAN vManage software (CVE-2023-20214, CVSS score: 9.1) that could allow an unauthenticated remote attacker to gain read or restricted access. write permissions to the configuration of the affected Cisco SD-WAN vManage instance.

“Successful exploitation could allow an attacker to obtain information from and send information to the configuration of the affected Cisco vManage instance,” the company said in a statement.

The vulnerability was fixed in versions 20.6.3.4, 20.6.4.2, 20.6.5.5, 20.9.3.2, 20.10.1.2 and 20.11.1.2. The network equipment company has stated that it is not aware of any malicious exploitation of this vulnerability.