CVE-2024-45516

Source
https://cve.org/CVERecord?id=CVE-2024-45516
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45516.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-45516
Published
2025-05-14T20:15:20.857Z
Modified
2026-04-12T10:46:39.501886Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in Zimbra Collaboration (ZCS) 9.0.0 before Patch 43, 10.0.x before 10.0.12, 10.1.x before 10.1.4, and 8.8.15 before Patch 47. A Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information. This issue arises from insufficient sanitization of HTML content, including malformed <img> tags with embedded JavaScript. The vulnerability is triggered when a user views a specially crafted email in the Classic UI, requiring no additional user interaction.

References

Affected packages

Git / github.com/zimbra/zm-build

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-build
Events
Introduced
Fixed
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Database specific
{
    "versions": [
        {
            "introduced": "10.1.0"
        },
        {
            "fixed": "10.1.4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p20"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p26"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p30"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p31"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p32"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p33"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p34"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p35"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p40"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p43"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p44"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p45"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p19"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p20"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p23"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p25"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p26"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p27"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p28"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p33"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p36"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p37"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p38"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p7"
        }
    ]
}
Type
GIT
Repo
https://github.com/zimbra/zm-mailbox
Events
Introduced
Fixed
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Database specific
{
    "versions": [
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.0.12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p15"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p16"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p17"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p18"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p23"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p24"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p25"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p27"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p29"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p31\\.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p36"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p37"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p39"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p41"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p46"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p16"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p17"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p18"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p22"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p24"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p24\\.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p29"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p30"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p32"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p34"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p39"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p40"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p41"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p9"
        }
    ]
}
Type
GIT
Repo
https://github.com/zimbra/zm-zcs-lib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
Database specific
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p21"
        }
    ]
}

Affected versions

10.*
10.0.0-GA
10.0.1
10.0.11
10.0.2
10.0.5
10.0.6
10.0.7
10.0.8
10.0.9
10.1.0
10.1.1
8.*
8.7.10
8.7.11
8.7.6
8.7.7
8.7.9
8.8.0.beta1
8.8.10
8.8.12
8.8.15
8.8.15.U20
8.8.15.p1
8.8.15.p10
8.8.15.p11
8.8.15.p12
8.8.15.p13
8.8.15.p14
8.8.15.p15
8.8.15.p15.nysa
8.8.15.p16
8.8.15.p17
8.8.15.p18
8.8.15.p2
8.8.15.p20
8.8.15.p21
8.8.15.p23
8.8.15.p24
8.8.15.p25
8.8.15.p26
8.8.15.p27
8.8.15.p29
8.8.15.p3
8.8.15.p30
8.8.15.p31
8.8.15.p31.1
8.8.15.p32
8.8.15.p33
8.8.15.p34
8.8.15.p35
8.8.15.p36
8.8.15.p37
8.8.15.p39
8.8.15.p4
8.8.15.p40
8.8.15.p41
8.8.15.p43
8.8.15.p44
8.8.15.p45
8.8.15.p46
8.8.15.p5
8.8.15.p6
8.8.15.p7
8.8.15.p8
8.8.15.p9
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.8.7
8.8.8
8.8.9
8.8.9.p1
8.8.9.p3
9.*
9.0.0
9.0.0.U20
9.0.0.p1
9.0.0.p10
9.0.0.p11
9.0.0.p13
9.0.0.p14
9.0.0.p16
9.0.0.p17
9.0.0.p18
9.0.0.p19
9.0.0.p2
9.0.0.p20
9.0.0.p22
9.0.0.p23
9.0.0.p24
9.0.0.p24.1
9.0.0.p25
9.0.0.p26
9.0.0.p27
9.0.0.p28
9.0.0.p29
9.0.0.p3
9.0.0.p30
9.0.0.p32
9.0.0.p33
9.0.0.p34
9.0.0.p36
9.0.0.p37
9.0.0.p38
9.0.0.p39
9.0.0.p4
9.0.0.p40
9.0.0.p41
9.0.0.p5
9.0.0.p6
9.0.0.p7
9.0.0.p7.1
9.0.0.p8
9.0.0.p9

Database specific

vanir_signatures_modified
"2026-04-12T10:46:39Z"
unresolved_ranges
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p19"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p22"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p28"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p38"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p42"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p12"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p15"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p21"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p31"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p35"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p42"
            }
        ]
    }
]
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45516.json"
vanir_signatures
[
    {
        "digest": {
            "length": 2910.0,
            "function_hash": "250239021129922179859369307689305685860"
        },
        "target": {
            "file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java",
            "function": "handle"
        },
        "signature_type": "Function",
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2024-45516-2802cfab",
        "source": "https://github.com/zimbra/zm-mailbox/commit/36b0176b086d3ced0cd751ec0aca4d9869574496"
    },
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "100352541356968744543459554936932541435",
                "34980778564753151690669805825885263298",
                "163615395104885010895005793672519100036",
                "324766885195200298088869019113793247780"
            ]
        },
        "target": {
            "file": "store/src/java/com/zimbra/cs/service/account/ChangePassword.java"
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "deprecated": false,
        "id": "CVE-2024-45516-8d17d1e8",
        "source": "https://github.com/zimbra/zm-mailbox/commit/36b0176b086d3ced0cd751ec0aca4d9869574496"
    }
]