« Volver al listado

CVE-2024-33536

Estado: ModificadaMedia (5.4)—

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading a malicious JavaScript file, accessible externally, and crafting a URL containing its location in the res parameter, the attacker can exploit this vulnerability. Subsequently, when another user visits the crafted URL, the malicious JavaScript code is executed.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zimbra — Collaboration

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-33536",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-33536",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-12T15:33:06.891365Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-08-12T15:15:20.657",
  "references": [
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.8#Security_Fixes",
      "tags": [
        "Release Notes"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P40#Security_Fixes",
      "tags": [
        "Release Notes"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability occurs due to inadequate input validation of the res parameter, allowing an authenticated attacker to inject and execute arbitrary JavaScript code within the context of another user's browser session. By uploading a malicious JavaScript file, accessible externally, and crafting a URL containing its location in the res parameter, the attacker can exploit this vulnerability. Subsequently, when another user visits the crafted URL, the malicious JavaScript code is executed."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en Zimbra Collaboration (ZCS) 9.0 y 10.0. La vulnerabilidad se produce debido a una validación de entrada inadecuada del parámetro res, lo que permite a un atacante autenticado inyectar y ejecutar código JavaScript arbitrario dentro del contexto de la sesión del navegador de otro usuario. Al cargar un archivo JavaScript malicioso, accesible externamente, y crear una URL que contenga su ubicación en el parámetro res, el atacante puede aprovechar esta vulnerabilidad. Posteriormente, cuando otro usuario visita la URL manipulada, se ejecuta el código JavaScript malicioso."
    }
  ],
  "lastModified": "2026-06-17T07:31:56.623",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5BC091A-EE5A-4D34-9D2E-754D3C2FCA3F",
              "versionEndExcluding": "10.0.8",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "685D9652-2934-4C13-8B36-40582C79BFC1"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E4DF01A-1AA9-47E8-82FD-65A02ECA1376"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDE59185-B917-4A81-8DE4-C65A079F52FE"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA3ED95F-95F2-4676-8EAF-B4B9EB64B260"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BB93336-CC3C-4B7F-B194-7DED036ABBAF"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "876F1675-F65C-4E86-ADBD-36EB8D8A997D"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2306F526-9C56-4A57-AA9B-02F2D6058C97"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9EA2A61-67AA-4B7E-BC6E-80EB1363EF85"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C77A35B7-96F6-43A7-A747-C6AEEDE961E1"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC35882B-E709-42D8-8800-F1B734CEAFC3"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7A47276-F241-4A68-9458-E1481EBDC5E6"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12D0D469-6C9B-4B66-9581-DC319773238A"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40629BEB-DF4B-4FB8-8D3D-7BAC43C90766"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9503131F-CC23-4545-AE9C-9714B287CC25"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4CE2D12-AD31-4FED-AD0F-ADF64E92E1B1"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8113A4E3-AA96-4382-815D-6FD88BA42EC5"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC8C28E0-6C51-41EE-A7B2-DB185D1D8FD0"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC19F11D-23D9-429D-A957-D67F23A40A01"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAFA2EE7-C965-4F27-8CAE-E607A9F202AD"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D09DCF6-1C8F-4CA1-B7D4-AFDD4EB35771"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C52705E6-2C6B-47BC-A0CD-F6AAE0BFC302"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD1DCE2B-D944-43AE-AD0E-9282DE6D618F"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2079B9F8-128B-487D-A965-E8B37FDF6304"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9679FD62-815E-47A8-8552-D28CE48B82B2"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D659AE6A-591E-4D5B-9781-9648250F5576"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4054E3E-561C-4B1C-A615-3CCE5CB69D77"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FA0E9C4-25E4-4CD6-B88A-02B413385866"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D6F7CA3-C36A-466C-8FAD-D0B3CEF01F0E"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9684AC81-B557-4292-8402-AE55CB2E613C"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32A352C4-0E9C-436F-ADA7-D93492A18037"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p39:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABCA8698-AB88-4A6D-BD2B-DB22AEED6536"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33F50D8C-7027-4A8D-8E95-98C224283772"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82000BA4-1781-4312-A7BD-92EC94D137AE"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B52D301-2559-457A-8FFB-F0915299355A"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7215AE2C-8A33-4AB9-88D5-7C8CD11E806C"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D859F77-8E39-4D46-BC90-C5C1D805A666"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDC810C7-45DA-4BDF-9138-2D3B2750243E"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E09D95A4-764D-4E0B-8605-1D94FD548AB2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}