{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-27915/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-27915/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-27915/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-27915/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-27915/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-27915"},"sightings":{"href":"/api/v1/sightings/cve-2025-27915"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-27915.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2025-27915\n\ninfo:\n  name: Zimbra - Cross-Site Scripting via ICS Files\n  author: Snbig,EhsanCreator,eliotworkspac-max\n  severity: medium\n  description: |\n    Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event inside a details tag, allowing attackers to perform unauthorized actions like email redirection and data exfiltration.\n  impact: |\n    Authenticated users viewing malicious ICS files can have JavaScript executed in their browser context through stored XSS, potentially leading to session hijacking and data exfiltration.\n  remediation: |\n    Upgrade to Zimbra Collaboration Suite version 9.0.1, 10.0.13, or 10.1.5 or later that properly sanitizes HTML content in ICS files.\n  reference:\n    - https://wiki.zimbra.com/wiki/Security_Center\n    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-27915\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 5.4\n    cve-id: CVE-2025-27915\n    cwe-id: CWE-79\n    epss-score: 0.03986\n    epss-percentile: 0.90061\n  metadata:\n    max-request: 1\n    verified: true\n    vendor: zimbra\n    product: collaboration\n    fofa-query: title=\"Zimbra Collaboration Suite\"\n    shodan-query: http.title:\"Zimbra Collaboration Suite\"\n  tags: cve,cve2025,zimbra,xss,ics,kev,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Zimbra Collaboration Suite\"\n\n      - type: word\n        part: header\n        words:\n          - \"application/x-javascript\"\n\n      - type: dsl\n        dsl:\n          - compare_versions(version, '9.0.0')\n          - compare_versions(version, '>= 10.0.0', '< 10.0.13')\n          - compare_versions(version, '>= 10.1.0', '< 10.1.5')\n        condition: or\n\n    extractors:\n      - type: regex\n        part: body\n        name: version\n        group: 1\n        regex:\n          - CLIENT_VERSION\\\",\\s+{type:ZmSetting\\.T_CONFIG, defaultValue:\"([0-9.]+)_([A-Z_0-9]+)\"\\}\n# digest: 4b0a00483046022100e2338bfc3ade7d8fb9dfd18164e984aeae854d9e6f7359d5985dea52487587ef0221008a2ab919b0e0dbe7ce151edf358cb444e788a1daff0b75c2e64fa0ec4edbffac:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-27915"}