Lucene search

MitreCVE-2024-27443

HistoryAug 12, 2024 - 3:15 p.m.

CVE-2024-27443

2024-08-1215:15:20

CWE-79

mitre

web.nvd.nist.gov

zimbra collaboration

xss vulnerability

calendarinvite

webmail

input validation

email message

crafted calendar header

xss payload

victim's session

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim’s session, potentially leading to execution of arbitrary JavaScript code.

Affected configurations

Nvd

Node

zimbracollaborationRange10.0.0–10.0.7

zimbracollaborationMatch9.0.0-

zimbracollaborationMatch9.0.0p0

zimbracollaborationMatch9.0.0p1

zimbracollaborationMatch9.0.0p10

zimbracollaborationMatch9.0.0p11

zimbracollaborationMatch9.0.0p12

zimbracollaborationMatch9.0.0p13

zimbracollaborationMatch9.0.0p14

zimbracollaborationMatch9.0.0p15

zimbracollaborationMatch9.0.0p16

zimbracollaborationMatch9.0.0p19

zimbracollaborationMatch9.0.0p2

zimbracollaborationMatch9.0.0p20

zimbracollaborationMatch9.0.0p21

zimbracollaborationMatch9.0.0p23

zimbracollaborationMatch9.0.0p24

zimbracollaborationMatch9.0.0p24.1

zimbracollaborationMatch9.0.0p25

zimbracollaborationMatch9.0.0p26

zimbracollaborationMatch9.0.0p27

zimbracollaborationMatch9.0.0p3

zimbracollaborationMatch9.0.0p30

zimbracollaborationMatch9.0.0p31

zimbracollaborationMatch9.0.0p32

zimbracollaborationMatch9.0.0p33

zimbracollaborationMatch9.0.0p34

zimbracollaborationMatch9.0.0p35

zimbracollaborationMatch9.0.0p36

zimbracollaborationMatch9.0.0p37

zimbracollaborationMatch9.0.0p38

zimbracollaborationMatch9.0.0p4

zimbracollaborationMatch9.0.0p5

zimbracollaborationMatch9.0.0p6

zimbracollaborationMatch9.0.0p7

zimbracollaborationMatch9.0.0p7.1

zimbracollaborationMatch9.0.0p8

zimbracollaborationMatch9.0.0p9

VendorProductVersionCPE
zimbracollaboration*cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*
zimbracollaboration9.0.0cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*
zimbracollaboration9.0.0cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*
zimbracollaboration9.0.0cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*
zimbracollaboration9.0.0cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*
zimbracollaboration9.0.0cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*
zimbracollaboration9.0.0cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*
zimbracollaboration9.0.0cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*
zimbracollaboration9.0.0cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*
zimbracollaboration9.0.0cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*

Vendor	Product	Version	CPE
zimbra	collaboration	*	cpe:2.3:a:zimbra:collaboration::::::::
zimbra	collaboration	9.0.0	cpe:2.3:a:zimbra:collaboration:9.0.0:-::::::
zimbra	collaboration	9.0.0	cpe:2.3:a:zimbra:collaboration:9.0.0:p0::::::
zimbra	collaboration	9.0.0	cpe:2.3:a:zimbra:collaboration:9.0.0:p1::::::
zimbra	collaboration	9.0.0	cpe:2.3:a:zimbra:collaboration:9.0.0:p10::::::
zimbra	collaboration	9.0.0	cpe:2.3:a:zimbra:collaboration:9.0.0:p11::::::
zimbra	collaboration	9.0.0	cpe:2.3:a:zimbra:collaboration:9.0.0:p12::::::
zimbra	collaboration	9.0.0	cpe:2.3:a:zimbra:collaboration:9.0.0:p13::::::
zimbra	collaboration	9.0.0	cpe:2.3:a:zimbra:collaboration:9.0.0:p14::::::
zimbra	collaboration	9.0.0	cpe:2.3:a:zimbra:collaboration:9.0.0:p15::::::

Rows per page:

1-10 of 381

References

wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes

wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

5.1

Confidence

High

EPSS

0.001

Percentile

17.7%

JSON

Related for CVE-2024-27443