6.1

CVE-2023-45207

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitising the JavaScript code present in a PDF document.)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zimbra ≫ Collaboration Version >= 10.0.0 < 10.0.5
Zimbra ≫ Collaboration Version8.8.15 Update-
Zimbra ≫ Collaboration Version8.8.15 Updatep1
Zimbra ≫ Collaboration Version8.8.15 Updatep10
Zimbra ≫ Collaboration Version8.8.15 Updatep11
Zimbra ≫ Collaboration Version8.8.15 Updatep12
Zimbra ≫ Collaboration Version8.8.15 Updatep13
Zimbra ≫ Collaboration Version8.8.15 Updatep14
Zimbra ≫ Collaboration Version8.8.15 Updatep15
Zimbra ≫ Collaboration Version8.8.15 Updatep16
Zimbra ≫ Collaboration Version8.8.15 Updatep17
Zimbra ≫ Collaboration Version8.8.15 Updatep18
Zimbra ≫ Collaboration Version8.8.15 Updatep19
Zimbra ≫ Collaboration Version8.8.15 Updatep2
Zimbra ≫ Collaboration Version8.8.15 Updatep20
Zimbra ≫ Collaboration Version8.8.15 Updatep21
Zimbra ≫ Collaboration Version8.8.15 Updatep22
Zimbra ≫ Collaboration Version8.8.15 Updatep23
Zimbra ≫ Collaboration Version8.8.15 Updatep24
Zimbra ≫ Collaboration Version8.8.15 Updatep25
Zimbra ≫ Collaboration Version8.8.15 Updatep26
Zimbra ≫ Collaboration Version8.8.15 Updatep27
Zimbra ≫ Collaboration Version8.8.15 Updatep28
Zimbra ≫ Collaboration Version8.8.15 Updatep29
Zimbra ≫ Collaboration Version8.8.15 Updatep3
Zimbra ≫ Collaboration Version8.8.15 Updatep30
Zimbra ≫ Collaboration Version8.8.15 Updatep31
Zimbra ≫ Collaboration Version8.8.15 Updatep32
Zimbra ≫ Collaboration Version8.8.15 Updatep33
Zimbra ≫ Collaboration Version8.8.15 Updatep34
Zimbra ≫ Collaboration Version8.8.15 Updatep35
Zimbra ≫ Collaboration Version8.8.15 Updatep37
Zimbra ≫ Collaboration Version8.8.15 Updatep4
Zimbra ≫ Collaboration Version8.8.15 Updatep40
Zimbra ≫ Collaboration Version8.8.15 Updatep41
Zimbra ≫ Collaboration Version8.8.15 Updatep42
Zimbra ≫ Collaboration Version8.8.15 Updatep43
Zimbra ≫ Collaboration Version8.8.15 Updatep5
Zimbra ≫ Collaboration Version8.8.15 Updatep6
Zimbra ≫ Collaboration Version8.8.15 Updatep7
Zimbra ≫ Collaboration Version8.8.15 Updatep8
Zimbra ≫ Collaboration Version8.8.15 Updatep9
Zimbra ≫ Collaboration Version9.0.0 Update-
Zimbra ≫ Collaboration Version9.0.0 Updatep0
Zimbra ≫ Collaboration Version9.0.0 Updatep1
Zimbra ≫ Collaboration Version9.0.0 Updatep10
Zimbra ≫ Collaboration Version9.0.0 Updatep11
Zimbra ≫ Collaboration Version9.0.0 Updatep12
Zimbra ≫ Collaboration Version9.0.0 Updatep13
Zimbra ≫ Collaboration Version9.0.0 Updatep14
Zimbra ≫ Collaboration Version9.0.0 Updatep15
Zimbra ≫ Collaboration Version9.0.0 Updatep16
Zimbra ≫ Collaboration Version9.0.0 Updatep19
Zimbra ≫ Collaboration Version9.0.0 Updatep2
Zimbra ≫ Collaboration Version9.0.0 Updatep20
Zimbra ≫ Collaboration Version9.0.0 Updatep21
Zimbra ≫ Collaboration Version9.0.0 Updatep23
Zimbra ≫ Collaboration Version9.0.0 Updatep24
Zimbra ≫ Collaboration Version9.0.0 Updatep24.1
Zimbra ≫ Collaboration Version9.0.0 Updatep25
Zimbra ≫ Collaboration Version9.0.0 Updatep26
Zimbra ≫ Collaboration Version9.0.0 Updatep27
Zimbra ≫ Collaboration Version9.0.0 Updatep3
Zimbra ≫ Collaboration Version9.0.0 Updatep30
Zimbra ≫ Collaboration Version9.0.0 Updatep31
Zimbra ≫ Collaboration Version9.0.0 Updatep32
Zimbra ≫ Collaboration Version9.0.0 Updatep33
Zimbra ≫ Collaboration Version9.0.0 Updatep34
Zimbra ≫ Collaboration Version9.0.0 Updatep35
Zimbra ≫ Collaboration Version9.0.0 Updatep36
Zimbra ≫ Collaboration Version9.0.0 Updatep4
Zimbra ≫ Collaboration Version9.0.0 Updatep5
Zimbra ≫ Collaboration Version9.0.0 Updatep6
Zimbra ≫ Collaboration Version9.0.0 Updatep7
Zimbra ≫ Collaboration Version9.0.0 Updatep7.1
Zimbra ≫ Collaboration Version9.0.0 Updatep8
Zimbra ≫ Collaboration Version9.0.0 Updatep9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.44% 0.627
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://wiki.zimbra.com/wiki/Security_Center
Vendor Advisory
Release Notes