4.8

CVE-2024-45194

In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads. An attacker with administrative access to the Zimbra Administration Panel can inject malicious JavaScript code while configuring an email account. This injected code is stored on the server and executed in the context of the victim's browser when interacting with specific elements in the web interface. (The vulnerability can be mitigated by properly sanitizing input parameters to prevent the injection of malicious code.)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Synacor ≫ Zimbra Collaboration Suite Version >= 10.0.0 < 10.0.9
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update -
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p1
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p10
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p11
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p12
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p13
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p14
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p15
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p16
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p17
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p18
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p19
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p2
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p20
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p21
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p22
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p23
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p24
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p24.1
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p25
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p26
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p27
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p28
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p29
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p3
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p30
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p31
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p32
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p33
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p34
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p35
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p36
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p37
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p38
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p39
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p4
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p40
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p5
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p6
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p7
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p8
Synacor ≫ Zimbra Collaboration Suite Version 9.0.0 Update p9
Synacor ≫ Zimbra Collaboration Suite Version 10.1.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.47% 0.367
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
CISA-ADP 4.8 1.7 2.7
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
Product
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes
Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes
Release Notes