CVE-2022-45911 - Vulnerability Details

Vendors	Products
Zimbra	Collaboration

Link	Providers
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-45911", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-03T14:24:03.221Z", "dateReserved": "2022-11-26T00:00:00", "datePublished": "2023-01-06T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-01-06T00:00:00"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"}, {"url": "https://wiki.zimbra.com/wiki/Security_Center"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T14:24:03.221Z"}, "title": "CVE Program Container", "references": [{"url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories", "tags": ["x_transferred"]}, {"url": "https://wiki.zimbra.com/wiki/Security_Center", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-45911 (string)

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

assignerShortName : mitre (string)

dateUpdated : 2024-08-03T14:24:03.221Z (string)

dateReserved : 2022-11-26T00:00:00 (string)

datePublished : 2023-01-06T00:00:00 (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

dateUpdated : 2023-01-06T00:00:00 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information. (string)

}

]

affected : [ »

0 : { »

vendor : n/a (string)

product : n/a (string)

versions : [ »

0 : { »

version : n/a (string)

status : affected (string)

}

]

}

]

references : [ »

0 : { »

url : https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories (string)

}

1 : { »

url : https://wiki.zimbra.com/wiki/Security_Center (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : n/a (string)

}

]

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T14:24:03.221Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories (string)

tags : [ »

0 : x_transferred (string)

]

}

1 : { »

url : https://wiki.zimbra.com/wiki/Security_Center (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "685D9652-2934-4C13-8B36-40582C79BFC1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*", "matchCriteriaId": "5E4DF01A-1AA9-47E8-82FD-65A02ECA1376", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*", "matchCriteriaId": "BDE59185-B917-4A81-8DE4-C65A079F52FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*", "matchCriteriaId": "BA3ED95F-95F2-4676-8EAF-B4B9EB64B260", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*", "matchCriteriaId": "4BB93336-CC3C-4B7F-B194-7DED036ABBAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*", "matchCriteriaId": "876F1675-F65C-4E86-ADBD-36EB8D8A997D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*", "matchCriteriaId": "2306F526-9C56-4A57-AA9B-02F2D6058C97", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*", "matchCriteriaId": "F9EA2A61-67AA-4B7E-BC6E-80EB1363EF85", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*", "matchCriteriaId": "C77A35B7-96F6-43A7-A747-C6AEEDE961E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*", "matchCriteriaId": "DC35882B-E709-42D8-8800-F1B734CEAFC3", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*", "matchCriteriaId": "B7A47276-F241-4A68-9458-E1481EBDC5E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*", "matchCriteriaId": "12D0D469-6C9B-4B66-9581-DC319773238A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*", "matchCriteriaId": "40629BEB-DF4B-4FB8-8D3D-7BAC43C90766", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*", "matchCriteriaId": "9503131F-CC23-4545-AE9C-9714B287CC25", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*", "matchCriteriaId": "B4CE2D12-AD31-4FED-AD0F-ADF64E92E1B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*", "matchCriteriaId": "8113A4E3-AA96-4382-815D-6FD88BA42EC5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*", "matchCriteriaId": "DC8C28E0-6C51-41EE-A7B2-DB185D1D8FD0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*", "matchCriteriaId": "BC19F11D-23D9-429D-A957-D67F23A40A01", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*", "matchCriteriaId": "AAFA2EE7-C965-4F27-8CAE-E607A9F202AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*", "matchCriteriaId": "1D09DCF6-1C8F-4CA1-B7D4-AFDD4EB35771", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*", "matchCriteriaId": "C52705E6-2C6B-47BC-A0CD-F6AAE0BFC302", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*", "matchCriteriaId": "33F50D8C-7027-4A8D-8E95-98C224283772", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*", "matchCriteriaId": "82000BA4-1781-4312-A7BD-92EC94D137AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*", "matchCriteriaId": "4B52D301-2559-457A-8FFB-F0915299355A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*", "matchCriteriaId": "7215AE2C-8A33-4AB9-88D5-7C8CD11E806C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*", "matchCriteriaId": "8D859F77-8E39-4D46-BC90-C5C1D805A666", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*", "matchCriteriaId": "CDC810C7-45DA-4BDF-9138-2D3B2750243E", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*", "matchCriteriaId": "E09D95A4-764D-4E0B-8605-1D94FD548AB2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Zimbra Collaboration (ZCS) 9.0. XSS puede ocurrir en la p\u00e1gina de inicio de sesi\u00f3n de la IU cl\u00e1sica inyectando c\u00f3digo JavaScript arbitrario en el campo username. Esto ocurre antes de que el usuario inicie sesi\u00f3n en el sistema, lo que significa que incluso si el atacante ejecuta JavaScript arbitrario, no obtendr\u00e1 ninguna informaci\u00f3n confidencial."}], "id": "CVE-2022-45911", "lastModified": "2024-11-21T07:29:56.003", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-01-06T23:15:09.673", "references": [{"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://wiki.zimbra.com/wiki/Security_Center"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://wiki.zimbra.com/wiki/Security_Center"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:* (string)

matchCriteriaId : 685D9652-2934-4C13-8B36-40582C79BFC1 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:* (string)

matchCriteriaId : 5E4DF01A-1AA9-47E8-82FD-65A02ECA1376 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:* (string)

matchCriteriaId : BDE59185-B917-4A81-8DE4-C65A079F52FE (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:* (string)

matchCriteriaId : BA3ED95F-95F2-4676-8EAF-B4B9EB64B260 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:* (string)

matchCriteriaId : 4BB93336-CC3C-4B7F-B194-7DED036ABBAF (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:* (string)

matchCriteriaId : 876F1675-F65C-4E86-ADBD-36EB8D8A997D (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:* (string)

matchCriteriaId : 2306F526-9C56-4A57-AA9B-02F2D6058C97 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:* (string)

matchCriteriaId : F9EA2A61-67AA-4B7E-BC6E-80EB1363EF85 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:* (string)

matchCriteriaId : C77A35B7-96F6-43A7-A747-C6AEEDE961E1 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:* (string)

matchCriteriaId : DC35882B-E709-42D8-8800-F1B734CEAFC3 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:* (string)

matchCriteriaId : B7A47276-F241-4A68-9458-E1481EBDC5E6 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:* (string)

matchCriteriaId : 12D0D469-6C9B-4B66-9581-DC319773238A (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:* (string)

matchCriteriaId : 40629BEB-DF4B-4FB8-8D3D-7BAC43C90766 (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:* (string)

matchCriteriaId : 9503131F-CC23-4545-AE9C-9714B287CC25 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:* (string)

matchCriteriaId : B4CE2D12-AD31-4FED-AD0F-ADF64E92E1B1 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:* (string)

matchCriteriaId : 8113A4E3-AA96-4382-815D-6FD88BA42EC5 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:* (string)

matchCriteriaId : DC8C28E0-6C51-41EE-A7B2-DB185D1D8FD0 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:* (string)

matchCriteriaId : BC19F11D-23D9-429D-A957-D67F23A40A01 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:* (string)

matchCriteriaId : AAFA2EE7-C965-4F27-8CAE-E607A9F202AD (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:* (string)

matchCriteriaId : 1D09DCF6-1C8F-4CA1-B7D4-AFDD4EB35771 (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:* (string)

matchCriteriaId : C52705E6-2C6B-47BC-A0CD-F6AAE0BFC302 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:* (string)

matchCriteriaId : 33F50D8C-7027-4A8D-8E95-98C224283772 (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:* (string)

matchCriteriaId : 82000BA4-1781-4312-A7BD-92EC94D137AE (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:* (string)

matchCriteriaId : 4B52D301-2559-457A-8FFB-F0915299355A (string)

vulnerable : true (boolean)

}

24 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:* (string)

matchCriteriaId : 7215AE2C-8A33-4AB9-88D5-7C8CD11E806C (string)

vulnerable : true (boolean)

}

25 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:* (string)

matchCriteriaId : 8D859F77-8E39-4D46-BC90-C5C1D805A666 (string)

vulnerable : true (boolean)

}

26 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:* (string)

matchCriteriaId : CDC810C7-45DA-4BDF-9138-2D3B2750243E (string)

vulnerable : true (boolean)

}

27 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:* (string)

matchCriteriaId : E09D95A4-764D-4E0B-8605-1D94FD548AB2 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username field. This occurs before the user logs into the system, which means that even if the attacker executes arbitrary JavaScript, they will not get any sensitive information. (string)

}

1 : { »

lang : es (string)

value : Se descubrió un problema en Zimbra Collaboration (ZCS) 9.0. XSS puede ocurrir en la página de inicio de sesión de la IU clásica inyectando código JavaScript arbitrario en el campo username. Esto ocurre antes de que el usuario inicie sesión en el sistema, lo que significa que incluso si el atacante ejecuta JavaScript arbitrario, no obtendrá ninguna información confidencial. (string)

}

]

id : CVE-2022-45911 (string)

lastModified : 2024-11-21T07:29:56.003 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-01-06T23:15:09.673 (string)

references : [ »

0 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://wiki.zimbra.com/wiki/Security_Center (string)

}

1 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://wiki.zimbra.com/wiki/Security_Center (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories (string)

}

]

sourceIdentifier : cve@mitre.org (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object