Zimbra Collaboration 8.8.15 Patch 20

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:zimbra:collaboration:8.8.15:p20:*:*:*:*:*:*

part: a version: 8.8.15 update: p20

VendorZimbra (2c2042e1-5f4a-5590-841f-bd7953d2bb5f)
ProductCollaboration (dc8aeab5-e039-5ffe-a16a-100a59003217)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/zimbra/zm-build purl2cpe 2026-06-01 10:12:36.214165
pkg:sourceforge/zimbra purl2cpe 2026-06-01 10:12:36.214166

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-45519 vulnerable 2026-06-08 06:48:06.679619 Details available
CRITICAL (10)
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
Published: 2024-10-02T00:00:00.000Z
Updated: 2026-02-03T19:27:04.871Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45518 vulnerable 2026-06-08 06:48:06.613525 Details available
An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE).
Published: 2024-10-22T00:00:00.000Z
Updated: 2024-10-22T18:10:41.843Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-48432 vulnerable 2026-06-08 06:14:27.218926 Details available
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for a webmail redirection endpoint) within en email message, e.g., if a victim clicks on that link within Zimbra webmail.
Published: 2024-02-13T00:00:00.000Z
Updated: 2025-03-25T16:01:09.054Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-45207 vulnerable 2026-06-08 06:12:42.269767 Details available
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitising the JavaScript code present in a PDF document.)
Published: 2024-02-13T00:00:00.000Z
Updated: 2025-03-27T19:21:44.415Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-45206 vulnerable 2026-06-08 06:12:42.216116 Details available
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting (XSS). (Adding an adequate message to avoid malicious code will mitigate this issue.)
Published: 2024-02-13T00:00:00.000Z
Updated: 2025-05-07T21:12:51.053Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-43103 vulnerable 2026-06-08 06:11:10.911533 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-43102 vulnerable 2026-06-08 06:11:10.895874 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-41106 vulnerable 2026-06-08 06:11:05.255089 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-34193 vulnerable 2026-06-08 06:06:24.853384 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-34192 vulnerable 2026-06-08 06:06:24.808682 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-29382 vulnerable 2026-06-08 06:02:40.084204 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-29381 vulnerable 2026-06-08 06:02:40.038502 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-26562 vulnerable 2026-06-08 05:57:39.990821 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-24032 vulnerable 2026-06-08 05:56:05.077763 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-24030 vulnerable 2026-06-08 05:56:05.039356 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-45913 vulnerable 2026-06-08 05:50:37.531591 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-24682 vulnerable 2026-06-08 05:41:01.336805 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-35208 vulnerable 2026-06-08 05:32:48.512835 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-35207 vulnerable 2026-06-08 05:32:48.494579 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-34807 vulnerable 2026-06-08 05:32:16.996026 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.