CVE-2024-33533

Опубликовано: 12 авг. 2024

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting (XSS) vulnerability has been identified in the Zimbra webmail admin interface. This vulnerability occurs due to inadequate input validation of the packages parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading a malicious JavaScript file and crafting a URL containing its location in the packages parameter, the attacker can exploit this vulnerability. Subsequently, when another user visits the crafted URL, the malicious JavaScript code is executed.

Ссылки

https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.8#Security_Fixes
Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P40#Security_Fixes
Release Notes

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*

Версия от 10.0.0 (включая) до 10.0.8 (исключая)

cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p39:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*

cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*

EPSS

Процентиль: 45%

0.00223

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-pmx7-9647-m98m

CVSS3: 5.4

github

больше 1 года назад

BDU:2024-06561

CVSS3: 5.4

fstec

больше 1 года назад

Уязвимость интерфейса администрирования корпоративной системы управления электронной почтой Zimbra Collaboration Suite (ZCS), позволяющая нарушителю выполнить произвольный код JavaScript

EPSS

Процентиль: 45%

0.00223

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79