Zimbra Releases Security Updates for SQL Injection, Stored XSS, and SSRF Vulnerabilities thehackernews.com/2025/02/z…

Zimbra has released software updates to address critical security flaws in its Collaboration software that, if successfully exploited, could result in information disclosure under certain conditions.

The vulnerability, tracked as CVE-2025-25064, carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as an SQL injection bug in the ZimbraSync Service SOAP endpoint affecting versions prior to 10.0.12 and 10.1.4.

Zimbra also said it addressed another critical vulnerability related to stored cross-site scripting (XSS) in the Zimbra Classic Web Client. The flaw is yet to be assigned a CVE identifier.

“The fix strengthens input sanitization and enhances security,” the company said in an advisory, adding the issue has been fixed in versions 9.0.0 Patch 44, 10.0.13, and 10.1.5.

The security defect has been patched in versions 9.0.0 Patch 43, 10.0.12, and 10.1.4. Customers are advised to update to the latest versions of Zimbra Collaboration for optimal protection.