PT-2024-13974 · Zimbra · Zimbra Collaboration

Published 2024-02-13 · Updated 2024-10-17 · CVE-2023-50808

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration versions prior to Kepler 9.0.0 Patch 38 GA

Description The issue allows DOM-based JavaScript injection in the Modern UI. This could potentially lead to malicious script execution. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations For versions prior to Kepler 9.0.0 Patch 38 GA, update to Kepler 9.0.0 Patch 38 GA or later to resolve the issue. As a temporary workaround, consider restricting access to the Modern UI until a patch is applied.

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2023-50808

Affected Products

Zimbra Collaboration

References · 7

• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-50808 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50808 · Vendor Advisory
• https://t.me/cvenotify/98484 · Telegram Post
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P38 · Note
• https://twitter.com/CVEnew/status/1757469686797939114 · Twitter Post
• https://wiki.zimbra.com/wiki/Security_Center · Note