Read the docs
TI-2024-30545 Aliases CVE-2024-45510GHSA-79x8-79gq-rxxc

An issue was discovered in Zimbra Collaboration (ZCS) through 10.0.

Priority LOW 27CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.

Summary

An issue was discovered in Zimbra Collaboration (ZCS) through 10.0. Zimbra Webmail (Modern UI) is vulnerable to a stored Cross-Site Scripting (XSS) attack due to improper sanitization of user input. This allows an attacker to inject malicious code into specific fields of an e-mail message. When the victim adds the attacker to their contacts, the malicious code is stored and executed when viewing the contact list. This can lead to unauthorized actions such as arbitrary mail sending, mailbox exfiltration, profile picture alteration, and other malicious actions. Proper sanitization and escaping of input fields are necessary to mitigate this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00324 25th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 43

CPEVersionsRoleVendor
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*before 9.0.0; 10.0.0 to before 10.0.9VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*9.0.0VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*9.0.0 p1VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*9.0.0 p10VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*9.0.0 p11VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*9.0.0 p12VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*9.0.0 p13VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*9.0.0 p14VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*9.0.0 p15VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*9.0.0 p16VulnerableSynacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* Versions before 9.0.0; 10.0.0 to before 10.0.9 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:* Versions 9.0.0 p1 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:* Versions 9.0.0 p10 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:* Versions 9.0.0 p11 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:* Versions 9.0.0 p12 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:* Versions 9.0.0 p13 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:* Versions 9.0.0 p14 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:* Versions 9.0.0 p15 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:* Versions 9.0.0 p16 Vulnerable ·Synacor
Show 33 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*9.0.0 p17VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*9.0.0 p18VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*9.0.0 p19VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*9.0.0 p2VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*9.0.0 p20VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*9.0.0 p21VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*9.0.0 p22VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*9.0.0 p23VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*9.0.0 p24VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*9.0.0 p24.1VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*9.0.0 p25VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*9.0.0 p26VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*9.0.0 p27VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*9.0.0 p28VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*9.0.0 p29VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*9.0.0 p3VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:*9.0.0 p30VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p31:*:*:*:*:*:*9.0.0 p31VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:*9.0.0 p32VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*9.0.0 p33VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:*9.0.0 p34VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p35:*:*:*:*:*:*9.0.0 p35VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:*9.0.0 p36VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:*9.0.0 p37VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*9.0.0 p38VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:*9.0.0 p39VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*9.0.0 p4VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:*9.0.0 p40VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*9.0.0 p5VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*9.0.0 p6VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*9.0.0 p7VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*9.0.0 p8VulnerableSynacor
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*9.0.0 p9VulnerableSynacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:* Versions 9.0.0 p17 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:* Versions 9.0.0 p18 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:* Versions 9.0.0 p19 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:* Versions 9.0.0 p2 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:* Versions 9.0.0 p20 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:* Versions 9.0.0 p21 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:* Versions 9.0.0 p22 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:* Versions 9.0.0 p23 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:* Versions 9.0.0 p24 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:* Versions 9.0.0 p24.1 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:* Versions 9.0.0 p25 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:* Versions 9.0.0 p26 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:* Versions 9.0.0 p27 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:* Versions 9.0.0 p28 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:* Versions 9.0.0 p29 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:* Versions 9.0.0 p3 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:* Versions 9.0.0 p30 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p31:*:*:*:*:*:* Versions 9.0.0 p31 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:* Versions 9.0.0 p32 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:* Versions 9.0.0 p33 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:* Versions 9.0.0 p34 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p35:*:*:*:*:*:* Versions 9.0.0 p35 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:* Versions 9.0.0 p36 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:* Versions 9.0.0 p37 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:* Versions 9.0.0 p38 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:* Versions 9.0.0 p39 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:* Versions 9.0.0 p4 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:* Versions 9.0.0 p40 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:* Versions 9.0.0 p5 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:* Versions 9.0.0 p6 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:* Versions 9.0.0 p7 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:* Versions 9.0.0 p8 Vulnerable ·Synacor
  • cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:* Versions 9.0.0 p9 Vulnerable ·Synacor

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45510
  2. 2026-10-03 Alias added: GHSA-79x8-79gq-rxxc

References

Advisory 1

Other 4

  • TI-2024-30554 The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before… KEVCVSS 3.1CRITICAL 10.0
  • TI-2022-19841 An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-17239 Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-10792 Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-06312 Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is… KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-07076 mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an… KEVCVSS 3.1CRITICAL 9.8
See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences