UpHeron
All vulnerabilities

Servers and applications

CVE-2024-45514

An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmail due to insufficient sanitization of the packages parameter. Attackers can bypass the existing checks by using encoded characters, allowing the injection and execution of arbitrary JavaScript within a victim's session.

Severity
Medium 5.4
Published
21 Nov 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.8.15, 10.0.9
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
  • Version 10.1.0
  • From 10.0.0 before 10.0.9
  • Version 9.0.0-p40
  • Version 9.0.0-p39
All 92 release lines
  • Every version before 8.8.15
  • Version 8.8.15
  • Version 8.8.15-p1
  • Version 8.8.15-p2
  • Version 8.8.15-p3
  • Version 8.8.15-p4
  • Version 8.8.15-p5
  • Version 8.8.15-p6
  • Version 8.8.15-p7
  • Version 8.8.15-p8
  • Version 8.8.15-p9
  • Version 8.8.15-p10
  • Version 8.8.15-p11
  • Version 8.8.15-p12
  • Version 8.8.15-p13
  • Version 8.8.15-p14
  • Version 8.8.15-p15
  • Version 8.8.15-p16
  • Version 8.8.15-p17
  • Version 8.8.15-p18
  • Version 8.8.15-p19
  • Version 8.8.15-p20
  • Version 8.8.15-p21
  • Version 8.8.15-p22
  • Version 8.8.15-p23
  • Version 8.8.15-p24
  • Version 8.8.15-p25
  • Version 8.8.15-p26
  • Version 8.8.15-p27
  • Version 8.8.15-p28
  • Version 8.8.15-p29
  • Version 8.8.15-p30
  • Version 8.8.15-p31
  • Version 8.8.15-p31.1
  • Version 8.8.15-p32
  • Version 8.8.15-p33
  • Version 8.8.15-p34
  • Version 8.8.15-p35
  • Version 8.8.15-p36
  • Version 8.8.15-p37
  • Version 8.8.15-p38
  • Version 8.8.15-p39
  • Version 8.8.15-p40
  • Version 8.8.15-p41
  • Version 8.8.15-p42
  • Version 8.8.15-p43
  • Version 8.8.15-p44
  • Version 8.8.15-p45
  • Version 9.0.0
  • Version 9.0.0-p1
  • Version 9.0.0-p2
  • Version 9.0.0-p3
  • Version 9.0.0-p4
  • Version 9.0.0-p5
  • Version 9.0.0-p6
  • Version 9.0.0-p7
  • Version 9.0.0-p8
  • Version 9.0.0-p9
  • Version 9.0.0-p10
  • Version 9.0.0-p11
  • Version 9.0.0-p12
  • Version 9.0.0-p13
  • Version 9.0.0-p14
  • Version 9.0.0-p15
  • Version 9.0.0-p16
  • Version 9.0.0-p17
  • Version 9.0.0-p18
  • Version 9.0.0-p19
  • Version 9.0.0-p20
  • Version 9.0.0-p21
  • Version 9.0.0-p22
  • Version 9.0.0-p23
  • Version 9.0.0-p24
  • Version 9.0.0-p24.1
  • Version 9.0.0-p25
  • Version 9.0.0-p26
  • Version 9.0.0-p27
  • Version 9.0.0-p28
  • Version 9.0.0-p29
  • Version 9.0.0-p30
  • Version 9.0.0-p31
  • Version 9.0.0-p32
  • Version 9.0.0-p33
  • Version 9.0.0-p34
  • Version 9.0.0-p35
  • Version 9.0.0-p36
  • Version 9.0.0-p37
  • Version 9.0.0-p38
  • Version 9.0.0-p39
  • Version 9.0.0-p40
  • From 10.0.0 before 10.0.9
  • Version 10.1.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-45514
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-45514