Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2024-45194: Zimbra Collaboration Webmail UI lets admin inject malicious script

CVE-2024-45194 · published 1 year ago

Summary

In Zimbra Collaboration versions 9.0 and 10.0, an admin can place hidden JavaScript code while setting up an email account. That code is saved on the server and runs in any user's browser when they use certain parts of the webmail interface, potentially stealing data or taking actions as the user. To protect yourself, ensure the web interface sanitizes all input or apply the vendor's recommended update or configuration change.

What to do

Update synacor zimbra_collaboration_suite to version 10.0.9 or later.

Affected software

Vendor	Product	Affected versions
synacor	zimbra_collaboration_suite	>= 10.0.0, < 10.0.9 9.0.0 10.1.0 `cpe:2.3:a:synacor:zimbra_collaboration_suite::::::::`

Original advisory text

In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads. An attacker with administrative access to the Zimbra Administration Panel can inject malicious JavaScript code while configuring an email account. This injected code is stored on the server and executed in the context of the victim's browser when interacting with specific elements in the web interface. (The vulnerability can be mitigated by properly sanitizing input parameters to prevent the injection of malicious code.)

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.8 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published21 Nov 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2024-45194 · NVD

CVE-2024-45194 · OSV

Track software like this

Free during beta