CVE-2024-45514

An issue was discovered in Zimbra Collaboration (ZCS) through v10.1

Medium · published November 21, 2024

CVSS v3.1
6.1
EPSS
1%
Percentile
49.6
In the wild
Unconfirmed
What it is

An issue was discovered in Zimbra Collaboration (ZCS) through v10.1. A Cross-Site Scripting (XSS) vulnerability exists in one of the endpoints of Zimbra Webmail due to insufficient sanitization of the packages parameter. Attackers can bypass the existing checks by using encoded characters, allowing the injection and execution of arbitrary JavaScript within a victim's session.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00632 · 49.6th percentile
Published
2024-11-21T00:00Z
EPSS history
Timeline
  • 21 NOV 00:00Z
    An issue was discovered in Zimbra Collaboration (ZCS) through v10.1
    cvelistv5