CVE-2022-45911

moderate-risk

Published 2023-01-06

An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information.

Do I need to act?

0.70% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.1/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Collaboration

Affected Vendors

Zimbra

References (4)

Vendor Advisory https://wiki.zimbra.com/wiki/Security_Center

Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Vendor Advisory https://wiki.zimbra.com/wiki/Security_Center

Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

/ 100

moderate-risk

Severity 23/34 · High

Exploitability 2/34 · Minimal

Exposure 22/34 · High