UpHeron
All vulnerabilities

Servers and applications

CVE-2022-37044

In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine.

Severity
Medium 6.1
Published
12 Aug 2022
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:zimbra:collaboration
  • Version 8.8.15

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-37044
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-37044