VDB
CVE-2024-45511
CVE-2024-45511
PUBLISHED
CVSS 8.600000381469727 HIGH
An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A reflected Cross-Site Scripting (XSS) issue exists through the Briefcase module due to improper sanitization of file content by the OnlyOffice formatter. This occurs when the victim opens a crafted URL pointing to a shared folder containing a malicious file uploaded by the attacker. The vulnerability allows the attacker to execute arbitrary JavaScript in the context of the victim's session.
EPSS 0.31% · 22.7th percentile
Risk Scores
CVSS 4.0
8.600000381469727
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.31%
22.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| synacor | zimbra_collaboration_suite | 0, 10.1.0 |
Timeline
- Sep 5, 2024 CVE Published
- Nov 20, 2024 Coalition ESS Score
- Nov 20, 2024 PoC Published
- Nov 20, 2024 PoC Published
- Nov 21, 2024 EPSS Score
- Dec 9, 2024 EPSS Score
- Dec 27, 2024 EPSS Score
- Jan 13, 2025 EPSS Score
- Jan 31, 2025 EPSS Score
- Feb 17, 2025 EPSS Score
- Mar 7, 2025 EPSS Score
- Mar 24, 2025 EPSS Score
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-45511 advisory
- https://wiki.zimbra.com/wiki/Security_Center url
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes url
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes url
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy url
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1 advisory