Cross-Site Scripting in Zimbra Collaboration by Zimbra
CVE-2023-24031

6.1MEDIUM

Key Information:

Vendor

Zimbra

Status
Collaboration
Vendor
CVE Published:
15 June 2023

What is CVE-2023-24031?

A vulnerability has been identified in Zimbra Collaboration Suite (ZCS) versions 9.0 and 8.8.15, enabling attackers to exploit a Cross-Site Scripting (XSS) flaw via specific attributes in the webmail /h/ endpoint. This can result in the execution of arbitrary JavaScript code, potentially leading to unauthorized information disclosure, threatening user data integrity and privacy.

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://wiki.zimbra.com/wiki/Security_Center

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.