6.1

CVE-2022-45911

An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zimbra ≫ Collaboration Version9.0.0 Update-
Zimbra ≫ Collaboration Version9.0.0 Updatep0
Zimbra ≫ Collaboration Version9.0.0 Updatep1
Zimbra ≫ Collaboration Version9.0.0 Updatep10
Zimbra ≫ Collaboration Version9.0.0 Updatep11
Zimbra ≫ Collaboration Version9.0.0 Updatep12
Zimbra ≫ Collaboration Version9.0.0 Updatep13
Zimbra ≫ Collaboration Version9.0.0 Updatep14
Zimbra ≫ Collaboration Version9.0.0 Updatep15
Zimbra ≫ Collaboration Version9.0.0 Updatep16
Zimbra ≫ Collaboration Version9.0.0 Updatep19
Zimbra ≫ Collaboration Version9.0.0 Updatep2
Zimbra ≫ Collaboration Version9.0.0 Updatep20
Zimbra ≫ Collaboration Version9.0.0 Updatep21
Zimbra ≫ Collaboration Version9.0.0 Updatep23
Zimbra ≫ Collaboration Version9.0.0 Updatep24
Zimbra ≫ Collaboration Version9.0.0 Updatep24.1
Zimbra ≫ Collaboration Version9.0.0 Updatep25
Zimbra ≫ Collaboration Version9.0.0 Updatep26
Zimbra ≫ Collaboration Version9.0.0 Updatep27
Zimbra ≫ Collaboration Version9.0.0 Updatep3
Zimbra ≫ Collaboration Version9.0.0 Updatep4
Zimbra ≫ Collaboration Version9.0.0 Updatep5
Zimbra ≫ Collaboration Version9.0.0 Updatep6
Zimbra ≫ Collaboration Version9.0.0 Updatep7
Zimbra ≫ Collaboration Version9.0.0 Updatep7.1
Zimbra ≫ Collaboration Version9.0.0 Updatep8
Zimbra ≫ Collaboration Version9.0.0 Updatep9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.45% 0.631
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.