PT-2024-7919 · Zimbra · Zimbra Collaboration Suite

Clément Lecigne · Published 2024-11-07 · Updated 2024-11-08 · CVE-2024-50599

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite version 8.8.15

Description A reflected Cross-Site Scripting (XSS) issue has been identified, arising from improper handling of user-supplied input. This allows an attacker to inject malicious code that is reflected back in the HTML response, affecting one of the webmail calendar endpoints. The vulnerability may enable a remote attacker to conduct a cross-site scripting (XSS) attack, potentially leading to data theft or account takeover.

Recommendations For Zimbra Collaboration Suite version 8.8.15, update the system to a patched version to mitigate the threats associated with this issue. As a temporary workaround, consider restricting access to the affected webmail calendar endpoint until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-09423

CVE-2024-50599

Affected Products

Zimbra Collaboration Suite

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2024-50599 · Security Note
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-50599 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09423 · Security Note
• https://github.com/advisories/GHSA-hj33-fc7c-p84c · Note
• https://twitter.com/CVEnew/status/1854633728930099221 · Twitter Post
• https://twitter.com/oktsec/status/1854684663194734855 · Twitter Post
• https://t.me/cvedetector/10130 · Telegram Post
• https://qualys.com/vulnerability-detection-pipeline · Note
• https://twitter.com/VulmonFeeds/status/1854716415548260732 · Twitter Post
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes · Note
• https://prio-n.com/kb/vulnerability/CVE-2024-50599 · Note