VulnerabilityAnalyzed

CVE-2024-45516

A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information.

MEDIUM 6.1EPSS 0.41%

Does this matter?

Lower severity and a low EPSS score (0.41%). Track it; it rarely justifies an emergency change on its own.

Description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, including malformed <img> tags with embedded JavaScript. The vulnerability is triggered when a user views a specially crafted email in the Classic UI, requiring no additional user interaction.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.41% probability · 34th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: synacor/zimbra collaboration suite
Source: cve@mitre.org

References

https://wiki.zimbra.com/wiki/Security_CenterVendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_FixesRelease Notes
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_PolicyProduct
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.