UpHeron
All vulnerabilities

Servers and applications

CVE-2024-45194

In Zimbra Collaboration (ZCS) 9.0 and 10.0, a vulnerability in the Webmail Modern UI allows execution of stored Cross-Site Scripting (XSS) payloads. An attacker with administrative access to the Zimbra Administration Panel can inject malicious JavaScript code while configuring an email account. This injected code is stored on the server and executed in the context of the victim's browser when…

Severity
Medium 4.8
Published
21 Nov 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.0.9
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
  • Version 10.1.0
  • From 10.0.0 before 10.0.9
  • Version 9.0.0-p40
  • Version 9.0.0-p39
All 44 release lines
  • Version 9.0.0
  • Version 9.0.0-p1
  • Version 9.0.0-p2
  • Version 9.0.0-p3
  • Version 9.0.0-p4
  • Version 9.0.0-p5
  • Version 9.0.0-p6
  • Version 9.0.0-p7
  • Version 9.0.0-p8
  • Version 9.0.0-p9
  • Version 9.0.0-p10
  • Version 9.0.0-p11
  • Version 9.0.0-p12
  • Version 9.0.0-p13
  • Version 9.0.0-p14
  • Version 9.0.0-p15
  • Version 9.0.0-p16
  • Version 9.0.0-p17
  • Version 9.0.0-p18
  • Version 9.0.0-p19
  • Version 9.0.0-p20
  • Version 9.0.0-p21
  • Version 9.0.0-p22
  • Version 9.0.0-p23
  • Version 9.0.0-p24
  • Version 9.0.0-p24.1
  • Version 9.0.0-p25
  • Version 9.0.0-p26
  • Version 9.0.0-p27
  • Version 9.0.0-p28
  • Version 9.0.0-p29
  • Version 9.0.0-p30
  • Version 9.0.0-p31
  • Version 9.0.0-p32
  • Version 9.0.0-p33
  • Version 9.0.0-p34
  • Version 9.0.0-p35
  • Version 9.0.0-p36
  • Version 9.0.0-p37
  • Version 9.0.0-p38
  • Version 9.0.0-p39
  • Version 9.0.0-p40
  • From 10.0.0 before 10.0.9
  • Version 10.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-45194
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-45194