CVE-2023-24031

Zimbra Collaboration (ZCS) versions 8.8.15 through 9.0 are affected by an XSS vulnerability in the webmail /h/ endpoint. The root cause is inadequate protection of the web page structure, allowing an attacker to inject JavaScript and cause information disclosure. A practical workaround is to disa...

Vulnerabilities fixed in Zimbra Collaboration Suite

Zimbra has fixed vulnerabilities in the Zimbra Collaboration Suite ZCS. A malicious party can exploit the vulnerabilities to perform attacks that could result in the following categories of damage: Cross-Site Scripting XSS Denial-of-Service DoS. Bypassing authentication Bypassing security measure...

CVE-2022-45913

Zimbra Collaboration (ZCS) 9.0 is affected by a Cross‑Site Scripting (XSS) issue in attributes of webmail URLs that can lead to information disclosure. The vulnerability is associated with ZCS 9.0 and is addressed by updates in Zimbra 9.0.0 patch 28 (and in 8.8.15 patch 35 for older branches). No...

CVE-2022-45912

CVE-2022-45912 affects Zimbra Collaboration (ZCS) 8.8.15 and 9.0, where an authenticated administrator can abuse the ClientUploader utility to upload files and traverse directories, enabling remote code execution. The vulnerability originates from how ClientUploader handles uploads, permitting tr...

CVE-2022-3569

CVE-2022-3569 affects Zimbra Collaboration Suite (ZCS) versions 9.0.0 and earlier. The issue is a local privilege escalation caused by incorrect sudo permissions that let the zimbra user coerce postfix to run commands as root, enabling root-level command execution. Public exploit avenues exist (e...

Zimbra Collaboration Suite phone cross-site scripting vulnerability

Synacor Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A cross-site scripting vulnerability exists in Zimbra Collaboration Suite version 8.8.15, which stems from the lack of effective filtering...

Information disclosure

An issue was discovered in Zimbra Collaboration ZCS 9.0. XSS can occur via the onerror attribute of an IMG element, leading to information disclosure...

CVE-2022-41348

CVE-2022-41348 affects Zimbra Collaboration (ZCS) 9.0. An XSS vulnerability exists via the onerror attribute of an IMG element, potentially leading to information disclosure. Multiple connected sources corroborate this description. The vulnerability is tied to ZCS 9.0 and is described as an XSS i...

CVE-2022-41349

CVE-2022-41349 affects Zimbra Collaboration Suite (ZCS) 8.8.15. The vulnerability is a Reflected XSS in the /h/compose endpoint, where the attachUrl parameter is not properly sanitized, allowing execution of arbitrary JavaScript in a victim’s browser. Affected product/version: ZCS 8.8.15. Underly...

CVE-2022-41351

CVE-2022-41351 affects Zimbra Collaboration Suite (ZCS) 8.8.15. The vulnerability is a cross-site scripting (XSS) flaw at the /h/calendar endpoint, triggered by inserting JavaScript into the view parameter and setting the uncheck parameter to a non-numeric string. The underlying issue is describe...

CVE-2022-41350

CVE-2022-41350 affects Zimbra Collaboration Suite (ZCS) 8.8.15. The vulnerability is a Reflected XSS in the /h/search?action=voicemail&action=listen endpoint where the phone parameter is not properly sanitized, allowing execution of arbitrary JavaScript on the victim’s machine. Public documents c...

CVE-2022-41347

CVE-2022-41347 affects Zimbra Collaboration Suite (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The issue arises from a sudo configuration that allows the zimbra user to execute the NGINX binary as root with arbitrary parameters. Since NGINX can load a user-defined configuration file that loads plugins as ...

CVE-2022-41352

CVE-2022-41352 affects Zimbra Collaboration (ZCS) 8.8.15 and 9.0. The issue arises from an amavis/cpio handling path traversal that can cause arbitrary file writes to /opt/zimbra/jetty/webapps/zimbra/public, enabling unauthorized access to other user accounts. Public details confirm the root caus...

CVE-2022-37042

Zimbra Collaboration Suite ZCS 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication i.e., not having an authtoken, an attacker can upload arbitrary files to the system, leading to directory traversal and remote code...

CVE-2022-37044

Affected software: Zimbra Collaboration Suite (ZCS) 8.8.15. Vulnerability: Reflected XSS in the /h/search?action endpoint, where parameters extra, title, and onload are partially sanitized. This can allow execution of arbitrary JavaScript in the victim’s browser. Impact: Client-side script execut...

CVE-2022-37043

CVE-2022-37043 affects Zimbra Collaboration Suite webmail (ZCS) 8.8.15 and 9.0.0. The issue is a preauth CSRF flaw where CSRF tokens are not checked on certain POST endpoints, allowing an authenticated user viewing an attacker‑controlled page to cause the application to process requests that appe...

CVE-2022-37042

CVE-2022-37042 affects Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The vulnerability arises in the mboximport endpoint that accepts a ZIP archive; when an attacker bypasses authentication (no authtoken), they can upload arbitrary files, causing directory traversal and remote code execution. ...

CVE-2022-27926

Zimbra Collaboration (ZCS) 9.0 is affected by a reflected XSS in /public/launchNewWindow.jsp that allows unauthenticated attackers to execute arbitrary script or HTML via request parameters. The issue is confirmed across multiple sources (NVD/Nuclei/CISA KEV/CNVD) with the impact described as cli...

CVE-2022-27925

CVE-2022-27925 affects Zimbra Collaboration Suite 8.8.15 and 9.0, where mboximport accepts a ZIP and extracts files. An authenticated administrator can upload arbitrary files, enabling directory traversal. Public PoCs/exploits in connected docs demonstrate path traversal behavior and indicate aff...

CVE-2022-27924

CVE-2022-27924 affects Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0, allowing an unauthenticated attacker to inject arbitrary memcache commands into a targeted ZCS instance, with those commands becoming unescaped and enabling overwriting of arbitrary cached entries and extraction of credential...