CVE-2024-45517: XSS
First published: Thu Nov 21 2024(Updated: )
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability in the /h/rest endpoint of the Zimbra webmail and admin panel interfaces allows attackers to execute arbitrary JavaScript in the victim's session. This issue is caused by improper sanitization of user input, leading to potential compromise of sensitive information. Exploitation requires user interaction to access the malicious URL.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zimbra Collaboration Suite | <=10.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
Frequently Asked Questions
What is the severity of CVE-2024-45517?
CVE-2024-45517 has been classified as a high-severity vulnerability due to its potential to execute arbitrary JavaScript in victim sessions.
How do I fix CVE-2024-45517?
To mitigate CVE-2024-45517, update Zimbra Collaboration to the latest version beyond 10.1 where the issue is resolved.
What are the main impacts of CVE-2024-45517?
CVE-2024-45517 allows attackers to perform Cross-Site Scripting (XSS) attacks, compromising user sessions and potentially leading to data theft.
How can I identify if my system is vulnerable to CVE-2024-45517?
Check if you are using Zimbra Collaboration version 10.1 or earlier, which is affected by CVE-2024-45517.
Is CVE-2024-45517 specific to certain Zimbra interfaces?
Yes, CVE-2024-45517 specifically affects the /h/rest endpoint of the Zimbra webmail and admin panel interfaces.
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/last-modified-date
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/zimbra
- canonical/zimbra collaboration suite