5.4

CVE-2024-33536

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading a malicious JavaScript file, accessible externally, and crafting a URL containing its location in the res parameter, the attacker can exploit this vulnerability. Subsequently, when another user visits the crafted URL, the malicious JavaScript code is executed.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zimbra ≫ Collaboration Version >= 10.0.0 < 10.0.8
Zimbra ≫ Collaboration Version 9.0.0 Update -
Zimbra ≫ Collaboration Version 9.0.0 Update p0
Zimbra ≫ Collaboration Version 9.0.0 Update p1
Zimbra ≫ Collaboration Version 9.0.0 Update p10
Zimbra ≫ Collaboration Version 9.0.0 Update p11
Zimbra ≫ Collaboration Version 9.0.0 Update p12
Zimbra ≫ Collaboration Version 9.0.0 Update p13
Zimbra ≫ Collaboration Version 9.0.0 Update p14
Zimbra ≫ Collaboration Version 9.0.0 Update p15
Zimbra ≫ Collaboration Version 9.0.0 Update p16
Zimbra ≫ Collaboration Version 9.0.0 Update p19
Zimbra ≫ Collaboration Version 9.0.0 Update p2
Zimbra ≫ Collaboration Version 9.0.0 Update p20
Zimbra ≫ Collaboration Version 9.0.0 Update p21
Zimbra ≫ Collaboration Version 9.0.0 Update p23
Zimbra ≫ Collaboration Version 9.0.0 Update p24
Zimbra ≫ Collaboration Version 9.0.0 Update p24.1
Zimbra ≫ Collaboration Version 9.0.0 Update p25
Zimbra ≫ Collaboration Version 9.0.0 Update p26
Zimbra ≫ Collaboration Version 9.0.0 Update p27
Zimbra ≫ Collaboration Version 9.0.0 Update p3
Zimbra ≫ Collaboration Version 9.0.0 Update p30
Zimbra ≫ Collaboration Version 9.0.0 Update p31
Zimbra ≫ Collaboration Version 9.0.0 Update p32
Zimbra ≫ Collaboration Version 9.0.0 Update p33
Zimbra ≫ Collaboration Version 9.0.0 Update p34
Zimbra ≫ Collaboration Version 9.0.0 Update p35
Zimbra ≫ Collaboration Version 9.0.0 Update p36
Zimbra ≫ Collaboration Version 9.0.0 Update p37
Zimbra ≫ Collaboration Version 9.0.0 Update p38
Zimbra ≫ Collaboration Version 9.0.0 Update p39
Zimbra ≫ Collaboration Version 9.0.0 Update p4
Zimbra ≫ Collaboration Version 9.0.0 Update p5
Zimbra ≫ Collaboration Version 9.0.0 Update p6
Zimbra ≫ Collaboration Version 9.0.0 Update p7
Zimbra ≫ Collaboration Version 9.0.0 Update p7.1
Zimbra ≫ Collaboration Version 9.0.0 Update p8
Zimbra ≫ Collaboration Version 9.0.0 Update p9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.26% 0.176
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CISA-ADP 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.8#Security_Fixes
Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P40#Security_Fixes
Release Notes