CVE-2022-41350

2022-10-1200:00:00

mitre

www.cve.org

zimbra

collaboration suite

xss

vulnerability

javascript

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.7%

JSON

In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This allows executing arbitrary JavaScript on the victim’s machine.

References

wiki.zimbra.com/wiki/Security_Center

wiki.zimbra.com/wiki/Zimbra_Security_Advisories