Read the docs
TI-2023-09815 Aliases CVE-2023-24031GHSA-m2w7-whw4-8q9h

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15.

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information disclosure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00401 34th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*9.0.0VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*9.0.0 p0VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*9.0.0 p1VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*9.0.0 p10VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*9.0.0 p11VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*9.0.0 p12VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*9.0.0 p13VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*9.0.0 p14VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*9.0.0 p15VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*9.0.0 p19VulnerableZimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:* Versions 9.0.0 p0 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:* Versions 9.0.0 p1 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:* Versions 9.0.0 p10 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:* Versions 9.0.0 p11 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:* Versions 9.0.0 p12 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:* Versions 9.0.0 p13 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:* Versions 9.0.0 p14 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:* Versions 9.0.0 p15 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:* Versions 9.0.0 p19 Vulnerable ·Zimbra
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*9.0.0 p2VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*9.0.0 p23VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*9.0.0 p25VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*9.0.0 p26VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*9.0.0 p27VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*9.0.0 p3VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*9.0.0 p4VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*9.0.0 p5VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*9.0.0 p6VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*9.0.0 p7VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*9.0.0 p7.1VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*9.0.0 p8VulnerableZimbra
cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*9.0.0 p9VulnerableZimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:* Versions 9.0.0 p2 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:* Versions 9.0.0 p23 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:* Versions 9.0.0 p25 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:* Versions 9.0.0 p26 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:* Versions 9.0.0 p27 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:* Versions 9.0.0 p3 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:* Versions 9.0.0 p4 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:* Versions 9.0.0 p5 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:* Versions 9.0.0 p6 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:* Versions 9.0.0 p7 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:* Versions 9.0.0 p7.1 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:* Versions 9.0.0 p8 Vulnerable ·Zimbra
  • cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:* Versions 9.0.0 p9 Vulnerable ·Zimbra

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-24031
  2. 2026-10-03 Alias added: GHSA-m2w7-whw4-8q9h

References

Advisory 1

Other 1

  • TI-2024-18266 An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. KEVCVSS 3.1MEDIUM 6.1
  • TI-2024-30553 An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before… CVSS 3.1HIGH 8.8
  • TI-2022-13998 Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly… CVSS 3.1CRITICAL 9.8
  • TI-2023-13772 An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute… CVSS 3.1CRITICAL 9.8
  • TI-2023-13771 An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2023-27722 Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI. CVSS 3.1CRITICAL 9.1
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences