{"id":"CVE-2024-45514","url":"https://www.cyber-defence.io/tools/cve/CVE-2024-45514","generatedAt":"2026-10-28T03:25:16.106Z","title":"A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmail due to insufficient sanitization of the packages parameter.","description":"An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmail due to insufficient sanitization of the packages parameter. Attackers can bypass the existing checks by using encoded characters, allowing the injection and execution of arbitrary JavaScript within a victim's session.","published":"2024-11-21T16:15:26.000Z","lastModified":"2026-06-17T07:54:22.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"},"cwe":["CWE-79"],"affected":["synacor/zimbra collaboration suite"],"epss":{"score":0.00632,"percentile":0.49987,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.63%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes","tags":["Release Notes"],"source":"cve@mitre.org"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes","tags":["Release Notes"],"source":"cve@mitre.org"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes","tags":["Release Notes"],"source":"cve@mitre.org"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes","tags":["Release Notes"],"source":"cve@mitre.org"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy","tags":["Product"],"source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2024-45514","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}