CVE-2024-33536: Input Validation
First published: Mon Aug 12 2024(Updated: )
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading a malicious JavaScript file, accessible externally, and crafting a URL containing its location in the res parameter, the attacker can exploit this vulnerability. Subsequently, when another user visits the crafted URL, the malicious JavaScript code is executed.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| >=10.0.0<10.0.8 | ||
| =9.0.0 | ||
| =9.0.0-p0 | ||
| =9.0.0-p1 | ||
| =9.0.0-p10 | ||
| =9.0.0-p11 | ||
| =9.0.0-p12 | ||
| =9.0.0-p13 | ||
| =9.0.0-p14 | ||
| =9.0.0-p15 | ||
| =9.0.0-p16 | ||
| =9.0.0-p19 | ||
| =9.0.0-p2 | ||
| =9.0.0-p20 | ||
| =9.0.0-p21 | ||
| =9.0.0-p23 | ||
| =9.0.0-p24 | ||
| =9.0.0-p24.1 | ||
| =9.0.0-p25 | ||
| =9.0.0-p26 | ||
| =9.0.0-p27 | ||
| =9.0.0-p3 | ||
| =9.0.0-p30 | ||
| =9.0.0-p31 | ||
| =9.0.0-p32 | ||
| =9.0.0-p33 | ||
| =9.0.0-p34 | ||
| =9.0.0-p35 | ||
| =9.0.0-p36 | ||
| =9.0.0-p37 | ||
| =9.0.0-p38 | ||
| =9.0.0-p39 | ||
| =9.0.0-p4 | ||
| =9.0.0-p5 | ||
| =9.0.0-p6 | ||
| =9.0.0-p7 | ||
| =9.0.0-p7.1 | ||
| =9.0.0-p8 | ||
| =9.0.0-p9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-33536?
CVE-2024-33536 has a high severity rating due to its potential to allow authenticated attackers to execute arbitrary JavaScript code in other users' sessions.
How do I fix CVE-2024-33536?
To fix CVE-2024-33536, upgrade Zimbra Collaboration to version 10.0.8 or later or version 9.0.0 with the latest patch included.
What type of vulnerability is CVE-2024-33536?
CVE-2024-33536 is a cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2024-33536?
CVE-2024-33536 affects users of Zimbra Collaboration versions 9.0 and 10.0 prior to their respective fixed releases.
Can CVE-2024-33536 lead to data theft?
Yes, CVE-2024-33536 can lead to data theft as it allows attackers to execute malicious scripts in the context of another user's browser session.
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/weakness
- agent/severity
- agent/source
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/event
- vendor/zimbra