An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A stored Cross-Site Scripting (XSS) vulnerability exists in the /modern/contacts/print endpoint of Zimbra webmail. This allows an attacker to inject and execute arbitrary JavaScript code in the context of the victim's browser when a crafted vCard (VCF) file is processed and printed. This could lead to unauthorized actions within the victim's session.
{
"unresolved_ranges": [
{
"extracted_events": [
{
"fixed": "10.1"
}
],
"source": "DESCRIPTION"
}
],
"cna_assigner": "mitre",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45513.json"
}{
"cpe": [
"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:10.1.0:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "9.0.0"
},
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.9"
},
{
"introduced": "9.0.0-NA"
},
{
"last_affected": "9.0.0-NA"
},
{
"introduced": "9.0.0-p1"
},
{
"last_affected": "9.0.0-p1"
},
{
"introduced": "9.0.0-p19"
},
{
"last_affected": "9.0.0-p19"
},
{
"introduced": "9.0.0-p20"
},
{
"last_affected": "9.0.0-p20"
},
{
"introduced": "9.0.0-p23"
},
{
"last_affected": "9.0.0-p23"
},
{
"introduced": "9.0.0-p25"
},
{
"last_affected": "9.0.0-p25"
},
{
"introduced": "9.0.0-p26"
},
{
"last_affected": "9.0.0-p26"
},
{
"introduced": "9.0.0-p27"
},
{
"last_affected": "9.0.0-p27"
},
{
"introduced": "9.0.0-p28"
},
{
"last_affected": "9.0.0-p28"
},
{
"introduced": "9.0.0-p33"
},
{
"last_affected": "9.0.0-p33"
},
{
"introduced": "9.0.0-p36"
},
{
"last_affected": "9.0.0-p36"
},
{
"introduced": "9.0.0-p37"
},
{
"last_affected": "9.0.0-p37"
},
{
"introduced": "9.0.0-p38"
},
{
"last_affected": "9.0.0-p38"
},
{
"introduced": "9.0.0-p4"
},
{
"last_affected": "9.0.0-p4"
},
{
"introduced": "9.0.0-p7"
},
{
"last_affected": "9.0.0-p7"
},
{
"introduced": "10.1.0"
},
{
"last_affected": "10.1.0"
}
],
"source": [
"CPE_RANGE",
"CPE_STRING"
]
}{
"cpe": [
"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:10.1.0:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "9.0.0"
},
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.9"
},
{
"introduced": "9.0.0-NA"
},
{
"last_affected": "9.0.0-NA"
},
{
"introduced": "9.0.0-p1"
},
{
"last_affected": "9.0.0-p1"
},
{
"introduced": "9.0.0-p10"
},
{
"last_affected": "9.0.0-p10"
},
{
"introduced": "9.0.0-p11"
},
{
"last_affected": "9.0.0-p11"
},
{
"introduced": "9.0.0-p13"
},
{
"last_affected": "9.0.0-p13"
},
{
"introduced": "9.0.0-p14"
},
{
"last_affected": "9.0.0-p14"
},
{
"introduced": "9.0.0-p16"
},
{
"last_affected": "9.0.0-p16"
},
{
"introduced": "9.0.0-p17"
},
{
"last_affected": "9.0.0-p17"
},
{
"introduced": "9.0.0-p18"
},
{
"last_affected": "9.0.0-p18"
},
{
"introduced": "9.0.0-p19"
},
{
"last_affected": "9.0.0-p19"
},
{
"introduced": "9.0.0-p2"
},
{
"last_affected": "9.0.0-p2"
},
{
"introduced": "9.0.0-p20"
},
{
"last_affected": "9.0.0-p20"
},
{
"introduced": "9.0.0-p22"
},
{
"last_affected": "9.0.0-p22"
},
{
"introduced": "9.0.0-p23"
},
{
"last_affected": "9.0.0-p23"
},
{
"introduced": "9.0.0-p24"
},
{
"last_affected": "9.0.0-p24"
},
{
"introduced": "9.0.0-p24\\.1"
},
{
"last_affected": "9.0.0-p24\\.1"
},
{
"introduced": "9.0.0-p25"
},
{
"last_affected": "9.0.0-p25"
},
{
"introduced": "9.0.0-p26"
},
{
"last_affected": "9.0.0-p26"
},
{
"introduced": "9.0.0-p27"
},
{
"last_affected": "9.0.0-p27"
},
{
"introduced": "9.0.0-p28"
},
{
"last_affected": "9.0.0-p28"
},
{
"introduced": "9.0.0-p29"
},
{
"last_affected": "9.0.0-p29"
},
{
"introduced": "9.0.0-p3"
},
{
"last_affected": "9.0.0-p3"
},
{
"introduced": "9.0.0-p30"
},
{
"last_affected": "9.0.0-p30"
},
{
"introduced": "9.0.0-p32"
},
{
"last_affected": "9.0.0-p32"
},
{
"introduced": "9.0.0-p33"
},
{
"last_affected": "9.0.0-p33"
},
{
"introduced": "9.0.0-p34"
},
{
"last_affected": "9.0.0-p34"
},
{
"introduced": "9.0.0-p38"
},
{
"last_affected": "9.0.0-p38"
},
{
"introduced": "9.0.0-p39"
},
{
"last_affected": "9.0.0-p39"
},
{
"introduced": "9.0.0-p4"
},
{
"last_affected": "9.0.0-p4"
},
{
"introduced": "9.0.0-p40"
},
{
"last_affected": "9.0.0-p40"
},
{
"introduced": "9.0.0-p5"
},
{
"last_affected": "9.0.0-p5"
},
{
"introduced": "9.0.0-p6"
},
{
"last_affected": "9.0.0-p6"
},
{
"introduced": "9.0.0-p7"
},
{
"last_affected": "9.0.0-p7"
},
{
"introduced": "9.0.0-p8"
},
{
"last_affected": "9.0.0-p8"
},
{
"introduced": "9.0.0-p9"
},
{
"last_affected": "9.0.0-p9"
},
{
"introduced": "10.1.0"
},
{
"last_affected": "10.1.0"
}
],
"source": [
"CPE_RANGE",
"CPE_STRING"
]
}"2026-07-22T03:35:31Z"
[
{
"signature_type": "Function",
"deprecated": false,
"digest": {
"length": 5736.0,
"function_hash": "339825474323013521183241826067317574250"
},
"signature_version": "v1",
"source": "https://github.com/zimbra/zm-mailbox/commit/a28371d6e77de652833e208a1c9d074f94ce36b4",
"id": "CVE-2024-45513-8f36f92c",
"target": {
"function": "handle",
"file": "store/src/java/com/zimbra/cs/service/mail/SaveDraft.java"
}
},
{
"signature_type": "Line",
"deprecated": false,
"digest": {
"threshold": 0.9,
"line_hashes": [
"337470034528614112051626076596091448768",
"206270029150699549176038490143151665801",
"255655912282109743755918710405709077885",
"171140784898272639202458916621426570256",
"262462816086553384881380158886169568146",
"287611038658038860516445880220323716532",
"95583691136116369616283734961458578373",
"221345564213786407153003906878025552530",
"129748365095992762317287749407585651371",
"163399839941821719543073122398703135171",
"155115778877998026564944218407819867158",
"252471202034437300847526430791461390849",
"31183811373230877232121826966060017583",
"316922818180324272441484121178638670636",
"137462080993319077135314138404951881241",
"188451475134819477117520408427906260665",
"25905982176558177072602329661744824783",
"132256262233950813561871574055221766980",
"319528592402864069938419172276206493032",
"143967281866102560867614478337965332463",
"89392272245757324774762688710421788068",
"230557637083376737053396039573273702338",
"197622903459566510185545266964825375464",
"217416885986732144975404456334001328503",
"153906800503353549862306626428652610342"
]
},
"signature_version": "v1",
"source": "https://github.com/zimbra/zm-mailbox/commit/a28371d6e77de652833e208a1c9d074f94ce36b4",
"id": "CVE-2024-45513-ae8bbb51",
"target": {
"file": "store/src/java/com/zimbra/cs/service/mail/SaveDraft.java"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45513.json"
{
"cpe": [
"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:10.1.0:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "9.0.0"
},
{
"introduced": "9.0.0-NA"
},
{
"last_affected": "9.0.0-NA"
},
{
"introduced": "9.0.0-p25"
},
{
"last_affected": "9.0.0-p25"
},
{
"introduced": "9.0.0-p26"
},
{
"last_affected": "9.0.0-p26"
},
{
"introduced": "10.1.0"
},
{
"last_affected": "10.1.0"
}
],
"source": [
"CPE_RANGE",
"CPE_STRING"
]
}{
"cpe": [
"cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*",
"cpe:2.3:a:synacor:zimbra_collaboration_suite:10.1.0:*:*:*:*:*:*:*"
],
"extracted_events": [
{
"introduced": "0"
},
{
"fixed": "9.0.0"
},
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.9"
},
{
"introduced": "9.0.0-NA"
},
{
"last_affected": "9.0.0-NA"
},
{
"introduced": "9.0.0-p13"
},
{
"last_affected": "9.0.0-p13"
},
{
"introduced": "9.0.0-p14"
},
{
"last_affected": "9.0.0-p14"
},
{
"introduced": "9.0.0-p16"
},
{
"last_affected": "9.0.0-p16"
},
{
"introduced": "9.0.0-p17"
},
{
"last_affected": "9.0.0-p17"
},
{
"introduced": "9.0.0-p23"
},
{
"last_affected": "9.0.0-p23"
},
{
"introduced": "9.0.0-p24"
},
{
"last_affected": "9.0.0-p24"
},
{
"introduced": "9.0.0-p25"
},
{
"last_affected": "9.0.0-p25"
},
{
"introduced": "9.0.0-p27"
},
{
"last_affected": "9.0.0-p27"
},
{
"introduced": "9.0.0-p3"
},
{
"last_affected": "9.0.0-p3"
},
{
"introduced": "9.0.0-p33"
},
{
"last_affected": "9.0.0-p33"
},
{
"introduced": "9.0.0-p4"
},
{
"last_affected": "9.0.0-p4"
},
{
"introduced": "10.1.0"
},
{
"last_affected": "10.1.0"
}
],
"source": [
"CPE_RANGE",
"CPE_STRING"
]
}