CVE-2024-45516

An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, including malformed <img> tags with embedded JavaScript. The vulnerability is triggered when a user views a specially crafted email in the Classic UI, requiring no additional user interaction.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
mitreCNA
---
---
CISA-ADPADP
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 2%
VendorProductVersion
synacorzimbra_collaboration_suite
10.0.0 ≤
𝑥
< 10.0.12
synacorzimbra_collaboration_suite
10.1.0 ≤
𝑥
< 10.1.4
synacorzimbra_collaboration_suite
8.8.15
synacorzimbra_collaboration_suite
8.8.15:p1
synacorzimbra_collaboration_suite
8.8.15:p10
synacorzimbra_collaboration_suite
8.8.15:p11
synacorzimbra_collaboration_suite
8.8.15:p12
synacorzimbra_collaboration_suite
8.8.15:p13
synacorzimbra_collaboration_suite
8.8.15:p14
synacorzimbra_collaboration_suite
8.8.15:p15
synacorzimbra_collaboration_suite
8.8.15:p16
synacorzimbra_collaboration_suite
8.8.15:p17
synacorzimbra_collaboration_suite
8.8.15:p18
synacorzimbra_collaboration_suite
8.8.15:p19
synacorzimbra_collaboration_suite
8.8.15:p2
synacorzimbra_collaboration_suite
8.8.15:p20
synacorzimbra_collaboration_suite
8.8.15:p21
synacorzimbra_collaboration_suite
8.8.15:p22
synacorzimbra_collaboration_suite
8.8.15:p23
synacorzimbra_collaboration_suite
8.8.15:p24
synacorzimbra_collaboration_suite
8.8.15:p25
synacorzimbra_collaboration_suite
8.8.15:p26
synacorzimbra_collaboration_suite
8.8.15:p27
synacorzimbra_collaboration_suite
8.8.15:p28
synacorzimbra_collaboration_suite
8.8.15:p29
synacorzimbra_collaboration_suite
8.8.15:p3
synacorzimbra_collaboration_suite
8.8.15:p30
synacorzimbra_collaboration_suite
8.8.15:p31
synacorzimbra_collaboration_suite
8.8.15:p31.1
synacorzimbra_collaboration_suite
8.8.15:p32
synacorzimbra_collaboration_suite
8.8.15:p33
synacorzimbra_collaboration_suite
8.8.15:p34
synacorzimbra_collaboration_suite
8.8.15:p35
synacorzimbra_collaboration_suite
8.8.15:p36
synacorzimbra_collaboration_suite
8.8.15:p37
synacorzimbra_collaboration_suite
8.8.15:p38
synacorzimbra_collaboration_suite
8.8.15:p39
synacorzimbra_collaboration_suite
8.8.15:p4
synacorzimbra_collaboration_suite
8.8.15:p40
synacorzimbra_collaboration_suite
8.8.15:p41
synacorzimbra_collaboration_suite
8.8.15:p42
synacorzimbra_collaboration_suite
8.8.15:p43
synacorzimbra_collaboration_suite
8.8.15:p44
synacorzimbra_collaboration_suite
8.8.15:p45
synacorzimbra_collaboration_suite
8.8.15:p46
synacorzimbra_collaboration_suite
8.8.15:p5
synacorzimbra_collaboration_suite
8.8.15:p6
synacorzimbra_collaboration_suite
8.8.15:p7
synacorzimbra_collaboration_suite
8.8.15:p8
synacorzimbra_collaboration_suite
8.8.15:p9
synacorzimbra_collaboration_suite
9.0.0
synacorzimbra_collaboration_suite
9.0.0:p1
synacorzimbra_collaboration_suite
9.0.0:p10
synacorzimbra_collaboration_suite
9.0.0:p11
synacorzimbra_collaboration_suite
9.0.0:p12
synacorzimbra_collaboration_suite
9.0.0:p13
synacorzimbra_collaboration_suite
9.0.0:p14
synacorzimbra_collaboration_suite
9.0.0:p15
synacorzimbra_collaboration_suite
9.0.0:p16
synacorzimbra_collaboration_suite
9.0.0:p17
synacorzimbra_collaboration_suite
9.0.0:p18
synacorzimbra_collaboration_suite
9.0.0:p19
synacorzimbra_collaboration_suite
9.0.0:p2
synacorzimbra_collaboration_suite
9.0.0:p20
synacorzimbra_collaboration_suite
9.0.0:p21
synacorzimbra_collaboration_suite
9.0.0:p22
synacorzimbra_collaboration_suite
9.0.0:p23
synacorzimbra_collaboration_suite
9.0.0:p24
synacorzimbra_collaboration_suite
9.0.0:p24.1
synacorzimbra_collaboration_suite
9.0.0:p25
synacorzimbra_collaboration_suite
9.0.0:p26
synacorzimbra_collaboration_suite
9.0.0:p27
synacorzimbra_collaboration_suite
9.0.0:p28
synacorzimbra_collaboration_suite
9.0.0:p29
synacorzimbra_collaboration_suite
9.0.0:p3
synacorzimbra_collaboration_suite
9.0.0:p30
synacorzimbra_collaboration_suite
9.0.0:p31
synacorzimbra_collaboration_suite
9.0.0:p32
synacorzimbra_collaboration_suite
9.0.0:p33
synacorzimbra_collaboration_suite
9.0.0:p34
synacorzimbra_collaboration_suite
9.0.0:p35
synacorzimbra_collaboration_suite
9.0.0:p36
synacorzimbra_collaboration_suite
9.0.0:p37
synacorzimbra_collaboration_suite
9.0.0:p38
synacorzimbra_collaboration_suite
9.0.0:p39
synacorzimbra_collaboration_suite
9.0.0:p4
synacorzimbra_collaboration_suite
9.0.0:p40
synacorzimbra_collaboration_suite
9.0.0:p41
synacorzimbra_collaboration_suite
9.0.0:p42
synacorzimbra_collaboration_suite
9.0.0:p5
synacorzimbra_collaboration_suite
9.0.0:p6
synacorzimbra_collaboration_suite
9.0.0:p7
synacorzimbra_collaboration_suite
9.0.0:p8
synacorzimbra_collaboration_suite
9.0.0:p9
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories