VYPR
← All advisories
Medium severity5.4NVD Advisory· Published Aug 12, 2024· Updated Jun 17, 2026

CVE-2024-33533

CVE-2024-33533

Description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0, issue 1 of 2. A reflected cross-site scripting (XSS) vulnerability has been identified in the Zimbra webmail admin interface. This vulnerability occurs due to inadequate input validation of the packages parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading a malicious JavaScript file and crafting a URL containing its location in the packages parameter, the attacker can exploit this vulnerability. Subsequently, when another user visits the crafted URL, the malicious JavaScript code is executed.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

42
  • Zimbra/Collaboration39 versions
    cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*+ 38 more
    • cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*range: >=10.0.0,<10.0.8
    • cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p39:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*
    • cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*
  • Zimbra/Zimbra Collaboration (ZCS)cpe-rescue2 versions
    (expand)+ 1 more
    • (no CPE)
    • (no CPE)
  • Zimbra/ZCSllm-fuzzy

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.