PT-2023-14792 · Zimbra · Zimbra Collaboration

Sk4Nd4 · Published 2023-01-06 · Updated 2023-01-12 · CVE-2022-45911

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) version 9.0

Description An issue was discovered in the Classic UI login page where XSS can occur by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information.

Recommendations For Zimbra Collaboration (ZCS) version 9.0, as a temporary workaround, consider restricting access to the Classic UI login page until a patch is available. Avoid using the username field in the affected login page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-45911

Affected Products

Zimbra Collaboration

References · 7

• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45911 · Security Note
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45911 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45911 · Note
• https://t.me/cvenotify/41461 · Telegram Post
• https://t.me/cibsecurity/56086 · Telegram Post