UpHeron
All vulnerabilities

Servers and applications

CVE-2024-45513

An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/contacts/print endpoint of Zimbra webmail. This allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser when a crafted vCard (VCF) file is processed and printed. This could lead to unauthorized actions within…

Severity
Medium 4.8
Published
21 Nov 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.0.0, 10.0.9
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
  • Version 10.1.0
  • From 10.0.0 before 10.0.9
  • Version 9.0.0-p40
  • Version 9.0.0-p39
All 45 release lines
  • Every version before 9.0.0
  • Version 9.0.0
  • Version 9.0.0-p1
  • Version 9.0.0-p2
  • Version 9.0.0-p3
  • Version 9.0.0-p4
  • Version 9.0.0-p5
  • Version 9.0.0-p6
  • Version 9.0.0-p7
  • Version 9.0.0-p8
  • Version 9.0.0-p9
  • Version 9.0.0-p10
  • Version 9.0.0-p11
  • Version 9.0.0-p12
  • Version 9.0.0-p13
  • Version 9.0.0-p14
  • Version 9.0.0-p15
  • Version 9.0.0-p16
  • Version 9.0.0-p17
  • Version 9.0.0-p18
  • Version 9.0.0-p19
  • Version 9.0.0-p20
  • Version 9.0.0-p21
  • Version 9.0.0-p22
  • Version 9.0.0-p23
  • Version 9.0.0-p24
  • Version 9.0.0-p24.1
  • Version 9.0.0-p25
  • Version 9.0.0-p26
  • Version 9.0.0-p27
  • Version 9.0.0-p28
  • Version 9.0.0-p29
  • Version 9.0.0-p30
  • Version 9.0.0-p31
  • Version 9.0.0-p32
  • Version 9.0.0-p33
  • Version 9.0.0-p34
  • Version 9.0.0-p35
  • Version 9.0.0-p36
  • Version 9.0.0-p37
  • Version 9.0.0-p38
  • Version 9.0.0-p39
  • Version 9.0.0-p40
  • From 10.0.0 before 10.0.9
  • Version 10.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-45513
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-45513