PT-2023-14792 · Zimbra · Zimbra Collaboration

Sk4Nd4 · Publicado 2023-01-06 · Atualizado 2023-01-12 · CVE-2022-45911

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) version 9.0

Description An issue was discovered in the Classic UI login page where XSS can occur by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information.

Recommendations For Zimbra Collaboration (ZCS) version 9.0, as a temporary workaround, consider restricting access to the Classic UI login page until a patch is available. Avoid using the username field in the affected login page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-45911

Produtos afetados

Zimbra Collaboration

Referências · 7

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45911 · Nota
• https://t.me/cvenotify/41461 · Publicação no Telegram
• https://wiki.zimbra.com/wiki/Security_Center · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-45911 · Nota de Segurança
• https://t.me/cibsecurity/56086 · Publicação no Telegram
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-45911 · Aviso do Fabricante