UpHeron
All vulnerabilities

Servers and applications

CVE-2024-45517

An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h/rest endpoint of the Zimbra webmail and admin panel interfaces allows attackers to execute arbitrary JavaScript in the victim's session. This issue is caused by improper sanitization of user input, leading to potential compromise of sensitive information. Exploitation requires…

Severity
Medium 5.4
Published
21 Nov 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.8.15, 10.0.9
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
  • Version 10.1.1
  • From 10.0.0 before 10.0.9
  • Version 9.0.0-p40
  • Version 9.0.0-p39
All 92 release lines
  • Every version before 8.8.15
  • Version 8.8.15
  • Version 8.8.15-p1
  • Version 8.8.15-p2
  • Version 8.8.15-p3
  • Version 8.8.15-p4
  • Version 8.8.15-p5
  • Version 8.8.15-p6
  • Version 8.8.15-p7
  • Version 8.8.15-p8
  • Version 8.8.15-p9
  • Version 8.8.15-p10
  • Version 8.8.15-p11
  • Version 8.8.15-p12
  • Version 8.8.15-p13
  • Version 8.8.15-p14
  • Version 8.8.15-p15
  • Version 8.8.15-p16
  • Version 8.8.15-p17
  • Version 8.8.15-p18
  • Version 8.8.15-p19
  • Version 8.8.15-p20
  • Version 8.8.15-p21
  • Version 8.8.15-p22
  • Version 8.8.15-p23
  • Version 8.8.15-p24
  • Version 8.8.15-p25
  • Version 8.8.15-p26
  • Version 8.8.15-p27
  • Version 8.8.15-p28
  • Version 8.8.15-p29
  • Version 8.8.15-p30
  • Version 8.8.15-p31
  • Version 8.8.15-p31.1
  • Version 8.8.15-p32
  • Version 8.8.15-p33
  • Version 8.8.15-p34
  • Version 8.8.15-p35
  • Version 8.8.15-p36
  • Version 8.8.15-p37
  • Version 8.8.15-p38
  • Version 8.8.15-p39
  • Version 8.8.15-p40
  • Version 8.8.15-p41
  • Version 8.8.15-p42
  • Version 8.8.15-p43
  • Version 8.8.15-p44
  • Version 8.8.15-p45
  • Version 9.0.0
  • Version 9.0.0-p1
  • Version 9.0.0-p2
  • Version 9.0.0-p3
  • Version 9.0.0-p4
  • Version 9.0.0-p5
  • Version 9.0.0-p6
  • Version 9.0.0-p7
  • Version 9.0.0-p8
  • Version 9.0.0-p9
  • Version 9.0.0-p10
  • Version 9.0.0-p11
  • Version 9.0.0-p12
  • Version 9.0.0-p13
  • Version 9.0.0-p14
  • Version 9.0.0-p15
  • Version 9.0.0-p16
  • Version 9.0.0-p17
  • Version 9.0.0-p18
  • Version 9.0.0-p19
  • Version 9.0.0-p20
  • Version 9.0.0-p21
  • Version 9.0.0-p22
  • Version 9.0.0-p23
  • Version 9.0.0-p24
  • Version 9.0.0-p24.1
  • Version 9.0.0-p25
  • Version 9.0.0-p26
  • Version 9.0.0-p27
  • Version 9.0.0-p28
  • Version 9.0.0-p29
  • Version 9.0.0-p30
  • Version 9.0.0-p31
  • Version 9.0.0-p32
  • Version 9.0.0-p33
  • Version 9.0.0-p34
  • Version 9.0.0-p35
  • Version 9.0.0-p36
  • Version 9.0.0-p37
  • Version 9.0.0-p38
  • Version 9.0.0-p39
  • Version 9.0.0-p40
  • From 10.0.0 before 10.0.9
  • Version 10.1.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-45517
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-45517