PT-2024-31671 · Zimbra · Zimbra Webmail+2

Published

2024-09-23

·

Updated

2025-06-11

·

CVE-2024-45510

CVSS v3.1

5.4

Medium

VectorAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration (ZCS) versions through 10.0
Description: A stored Cross-Site Scripting (XSS) attack is possible due to improper sanitization of user input in Zimbra Webmail (Modern UI). This allows an attacker to inject malicious code into specific fields of an e-mail message. When the victim adds the attacker to their contacts, the malicious code is stored and executed when viewing the contact list, potentially leading to unauthorized actions such as arbitrary mail sending, mailbox exfiltration, profile picture alteration, and other malicious actions.
Recommendations: For Zimbra Collaboration (ZCS) versions through 10.0, update to Zimbra Daffodil (v10.1.1) or later to fix the stored XSS vulnerability. As a temporary workaround, consider disabling the contact addition feature in Zimbra Webmail (Modern UI) until a patch is available. Restrict access to the contact list to minimize the risk of exploitation. Proper sanitization and escaping of input fields are necessary to mitigate this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-45510

Affected Products

Zimbra Collaboration
Zimbra Daffodil
Zimbra Webmail