This vulnerability (CWE-79) in Zimbra Collaboration Suite (ZCS) allows an unauthenticated calendar sender to inject malicious active markup into the RFC From address of a COUNTER message. The stored XSS triggers when the message is selected in the Zimbra Classic client, enabling the attacker to access sensitive mailbox data and perform actions as the victim user. The flaw affects all ZCS versions from 0 up to but not including 10.1.21. The CVSS 3.1 base score is 9.3, indicating a critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute stored cross-site scripting in the victim's mailbox interface, leading to unauthorized access to mailbox data and the ability to act as the victim user. This compromises confidentiality and integrity of mailbox contents but does not impact availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, users should monitor for updates from Zimbra and avoid interacting with suspicious calendar messages until a fix is available.