An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim.CreditsJonah Burgess (CryptoCat), Senior Security Researcher, Rapid7Referenceshttps://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
