Design/Logic Flaw

2022-08-1215:15:00

PRIOn knowledge base

www.prio-n.com

zimbra collaboration suite

security vulnerability

reflected xss

0.001 Low

EPSS

Percentile

33.5%

JSON

In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim’s machine.

CPENameOperatorVersion
collaborationeq8.8.15

CPE	Name	Operator	Version
	collaboration	eq	8.8.15

References

wiki.zimbra.com/wiki/Security_Center

wiki.zimbra.com/wiki/Zimbra_Security_Advisories

0.001 Low

EPSS

Percentile

33.5%

JSON

Related for PRION:CVE-2022-37044