The CVE exposes a request attribute override flaw in Zimbra Collaboration Suite that lets unauthenticated users send requests to the /h/* path, causing the RestFilter component to copy URL parameters—including an authentication token, target account, target item, and dispatch state—into servlet attributes used by the Classic Web Client. When combined with a related vulnerability in ZCS 10.1.16, an attacker can submit a valid token and document identifiers to inject and execute arbitrary JavaScript in another user’s signed‑in browser session. Although ZCS 10.1.17 blocks the XSS chain by changing the document renderer, it still permits the unsafe attribute override, enabling potential session hijacking, data theft, or client‑side compromise.

This flaw affects the Zimbra Collaboration Suite product. It has been identified in versions 10.1.16 and 10.1.17, with the earlier release being more susceptible because the XSS chain remains intact. All deployments running ZCS 10.1.16 or earlier, or those that have not applied the 10.1.17 update, are likely impacted. Operators using newer ZCS releases should review configuration settings controlling access to the /h/* endpoint.

The CVSS base score is 8.7, indicating a high severity vulnerability that can be exploited over the network by unauthenticated users. EPSS information is not available, and the advisory is not listed in the CISA KEV catalog. Because the flaw is exposed via a public URL endpoint, the likelihood of exploitation is moderate to high, especially for environments that have not yet upgraded. Attackers can use the endpoint to inject JavaScript and hijack user sessions; the weakness is identified as CWE‑642, related to information disclosure. The lack of an official workaround means operators must rely on patching or hardening network access.