UpHeron
All vulnerabilities

Servers and applications

CVE-2023-48432

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for a webmail redirection endpoint) within en email message, e.g., if a victim clicks on that link within Zimbra webmail.

Severity
Medium 6.1
Published
13 Feb 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.0.6
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:zimbra:collaboration
  • From 10.0.0 before 10.0.6
  • Version 9.0.0-p37
  • Version 9.0.0-p36
  • Version 9.0.0-p35
All 76 release lines
  • Version 8.8.15
  • Version 8.8.15-p1
  • Version 8.8.15-p2
  • Version 8.8.15-p3
  • Version 8.8.15-p4
  • Version 8.8.15-p5
  • Version 8.8.15-p6
  • Version 8.8.15-p7
  • Version 8.8.15-p8
  • Version 8.8.15-p9
  • Version 8.8.15-p10
  • Version 8.8.15-p11
  • Version 8.8.15-p12
  • Version 8.8.15-p13
  • Version 8.8.15-p14
  • Version 8.8.15-p15
  • Version 8.8.15-p16
  • Version 8.8.15-p17
  • Version 8.8.15-p18
  • Version 8.8.15-p19
  • Version 8.8.15-p20
  • Version 8.8.15-p21
  • Version 8.8.15-p22
  • Version 8.8.15-p23
  • Version 8.8.15-p24
  • Version 8.8.15-p25
  • Version 8.8.15-p26
  • Version 8.8.15-p27
  • Version 8.8.15-p28
  • Version 8.8.15-p29
  • Version 8.8.15-p30
  • Version 8.8.15-p31
  • Version 8.8.15-p32
  • Version 8.8.15-p33
  • Version 8.8.15-p34
  • Version 8.8.15-p35
  • Version 8.8.15-p37
  • Version 8.8.15-p40
  • Version 8.8.15-p41
  • Version 8.8.15-p42
  • Version 8.8.15-p43
  • Version 8.8.15-p44
  • Version 9.0.0
  • Version 9.0.0-p0
  • Version 9.0.0-p1
  • Version 9.0.0-p2
  • Version 9.0.0-p3
  • Version 9.0.0-p4
  • Version 9.0.0-p5
  • Version 9.0.0-p6
  • Version 9.0.0-p7
  • Version 9.0.0-p7.1
  • Version 9.0.0-p8
  • Version 9.0.0-p9
  • Version 9.0.0-p10
  • Version 9.0.0-p11
  • Version 9.0.0-p12
  • Version 9.0.0-p13
  • Version 9.0.0-p14
  • Version 9.0.0-p15
  • Version 9.0.0-p16
  • Version 9.0.0-p19
  • Version 9.0.0-p20
  • Version 9.0.0-p21
  • Version 9.0.0-p23
  • Version 9.0.0-p24
  • Version 9.0.0-p24.1
  • Version 9.0.0-p25
  • Version 9.0.0-p26
  • Version 9.0.0-p27
  • Version 9.0.0-p33
  • Version 9.0.0-p34
  • Version 9.0.0-p35
  • Version 9.0.0-p36
  • Version 9.0.0-p37
  • From 10.0.0 before 10.0.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-48432
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-48432