Digest · Tuesday

Security digest: May 30, 2023

1 editorial brief.

All digests · RSS · Markdown

Take stock

Check exposure: Zimbra CVE-2023-34192: 2023 XSS Added to KEV in 2025. Anyone still running Zimbra Collaboration 8.8.15, and above all servers below Patch 40 or with the web client reachable from the internet.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

May 30, 2023 · Vulnerability · CVE-2023-34192

Zimbra CVE-2023-34192: 2023 XSS Added to KEV in 2025

The bug was fixed in May 2023 and only hits Zimbra 8.8.15; the real problem is any 8.8.15 server still running, because that branch stopped receiving fixes at the end of 2024.

Must act: Anyone still running Zimbra Collaboration 8.8.15, and above all servers below Patch 40 or with the web client reachable from the internet.

Can relax: Zimbra servers on a current 10.1 patch and organizations that do not run self-hosted Zimbra.

Check the version on every Zimbra node with su - zimbra -c 'zmcontrol -v'.
If any node is below 8.8.15 Patch 40, patch it now as a stopgap.
Plan and run the migration off 8.8.15 to a current Zimbra 10.1 patch.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.