Zimbra Collaboration 8.8.15 Patch 22

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:zimbra:collaboration:8.8.15:p22:*:*:*:*:*:*

part: a version: 8.8.15 update: p22

VendorZimbra (2c2042e1-5f4a-5590-841f-bd7953d2bb5f)
ProductCollaboration (dc8aeab5-e039-5ffe-a16a-100a59003217)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/zimbra/zm-build purl2cpe 2026-06-01 10:12:36.214171
pkg:sourceforge/zimbra purl2cpe 2026-06-01 10:12:36.214173

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2024-45519 vulnerable 2026-06-08 06:48:06.679762 Details available
CRITICAL (10)
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
Published: 2024-10-02T00:00:00.000Z
Updated: 2026-02-03T19:27:04.871Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45518 vulnerable 2026-06-08 06:48:06.614928 Details available
An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE).
Published: 2024-10-22T00:00:00.000Z
Updated: 2024-10-22T18:10:41.843Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-48432 vulnerable 2026-06-08 06:14:27.220523 Details available
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. XSS, with resultant session stealing, can occur via JavaScript code in a link (for a webmail redirection endpoint) within en email message, e.g., if a victim clicks on that link within Zimbra webmail.
Published: 2024-02-13T00:00:00.000Z
Updated: 2025-03-25T16:01:09.054Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-45207 vulnerable 2026-06-08 06:12:42.269822 Details available
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. An attacker can send a PDF document through mail that contains malicious JavaScript. While previewing this file in webmail in the Chrome browser, the stored XSS payload is executed. (This has been mitigated by sanitising the JavaScript code present in a PDF document.)
Published: 2024-02-13T00:00:00.000Z
Updated: 2025-03-27T19:21:44.415Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-45206 vulnerable 2026-06-08 06:12:42.217617 Details available
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. Through the help document endpoint in webmail, an attacker can inject JavaScript or HTML code that leads to cross-site scripting (XSS). (Adding an adequate message to avoid malicious code will mitigate this issue.)
Published: 2024-02-13T00:00:00.000Z
Updated: 2025-05-07T21:12:51.053Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-43103 vulnerable 2026-06-08 06:11:10.911570 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-43102 vulnerable 2026-06-08 06:11:10.895910 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-41106 vulnerable 2026-06-08 06:11:05.256994 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-34193 vulnerable 2026-06-08 06:06:24.853424 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-34192 vulnerable 2026-06-08 06:06:24.810258 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-29382 vulnerable 2026-06-08 06:02:40.084342 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-29381 vulnerable 2026-06-08 06:02:40.039836 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-26562 vulnerable 2026-06-08 05:57:39.992691 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-24032 vulnerable 2026-06-08 05:56:05.077912 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-24030 vulnerable 2026-06-08 05:56:05.040620 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-45913 vulnerable 2026-06-08 05:50:37.534342 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-24682 vulnerable 2026-06-08 05:41:01.338166 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-35208 vulnerable 2026-06-08 05:32:48.513045 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-35207 vulnerable 2026-06-08 05:32:48.495987 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-34807 vulnerable 2026-06-08 05:32:16.997163 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.