CVE-2024-45512
Medium
Description
An issue was discovered in webmail in Zimbra Collaboration (ZCS) through 10.1. An attacker can exploit this vulnerability by creating a folder in the Briefcase module with a malicious payload and sharing it with a victim. When the victim interacts with the folder share notification, the malicious script executes in their browser. This stored Cross-Site Scripting (XSS) vulnerability can lead to unauthorized actions within the victim's session.
SeverityMedium
CVSS5.4
Exploit probability—
Product
Synacor Zimbra Collaboration Suite
PublishedNov 21, 2024
First seenNov 21, 2024
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- synacor zimbra_collaboration_suite9.0.0, 10.0.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| synacor zimbra_collaboration_suite | v < 9.0.0, 10.0.0 ≤ v < 10.0.9, 9.0.0, 10.1.0 | 9.0.0, 10.0.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.