An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, including malformed <img> tags with embedded JavaScript. The vulnerability is triggered when a user views a specially crafted email in the Classic UI, requiring no additional user interaction.
{
"versions": [
{
"introduced": "10.1.0"
},
{
"fixed": "10.1.4"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-NA"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p1"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p11"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p20"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p26"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p3"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p30"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p31"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p32"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p33"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p34"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p35"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p40"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p43"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p44"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p45"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p5"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-NA"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p1"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p19"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p20"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p23"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p25"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p26"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p27"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p28"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p33"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p36"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p37"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p38"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p4"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p7"
}
]
}{
"versions": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.12"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p10"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p12"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p13"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p14"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p15"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p16"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p17"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p18"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p2"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p23"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p24"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p25"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p27"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p29"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p31\\.1"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p36"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p37"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p39"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p4"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p41"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p46"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p6"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p7"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p8"
},
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p9"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p10"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p11"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p13"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p14"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p16"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p17"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p18"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p2"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p22"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p24"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p24\\.1"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p29"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p3"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p30"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p32"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p34"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p39"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p40"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p41"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p5"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p6"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p8"
},
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p9"
}
]
}"2026-04-12T10:46:39Z"
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p19"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p22"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p28"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p38"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "8.8.15-p42"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p12"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p15"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p21"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p31"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p35"
}
]
},
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "9.0.0-p42"
}
]
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45516.json"
[
{
"digest": {
"length": 2910.0,
"function_hash": "250239021129922179859369307689305685860"
},
"target": {
"file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java",
"function": "handle"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-45516-2802cfab",
"source": "https://github.com/zimbra/zm-mailbox/commit/36b0176b086d3ced0cd751ec0aca4d9869574496"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"100352541356968744543459554936932541435",
"34980778564753151690669805825885263298",
"163615395104885010895005793672519100036",
"324766885195200298088869019113793247780"
]
},
"target": {
"file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-45516-8d17d1e8",
"source": "https://github.com/zimbra/zm-mailbox/commit/36b0176b086d3ced0cd751ec0aca4d9869574496"
}
]