Zimbra Collaboration 9.0.0 Patch 41 Security Bulletin: RCE, SSRF, XSS Fixes (CVE-2024-45513, CVE-2024-45519)

From this webpage screenshot, the following key information about vulnerabilities can be obtained: 1. Security Fixes: - CVE-2024-45513: Fixed a stored XSS vulnerability in the endpoint. - CVE-2024-45519: Fixed a security vulnerability in the postjournal service that allowed unauthorized users to execute commands. - CVE-2024-45518: Fixed an SSRF (Server-Side Request Forgery) vulnerability that allowed unauthorized access to internal services. - CVE-2024-45194: Fixed an XSS (Cross-Site Scripting) vulnerability that allowed attackers to inject malicious code via email account configuration. - CVE-2024-45517: Fixed an XSS vulnerability in the endpoint. - CVE-2024-45516: Fixed an XSS vulnerability in Zimbra Classic UI triggered by crafted HTML content. - CVE-2024-45514: Fixed an XSS vulnerability caused by unsanitized parameter. - CVE-2024-45512: Fixed an XSS vulnerability in the Briefcase module that allowed execution of malicious code. - CVE-2024-45510: Fixed an XSS vulnerability that could lead to unauthorized operations when adding contacts from a crafted email. - CVE-2024-38356: Fixed an XSS vulnerability in TinyMCE. 2. Known Issues: - Email: - When replying or forwarding a plain text email with attachments, if the email format is switched to HTML after auto-saving the draft, an error message “Failed to Process this request” may appear. - When viewing emails containing any distribution lists, the distribution list may be displayed twice. - In Zimbra Modern UI, when the preview panel is disabled, the “Edit as New”, “New Event”, and “Print” functions do not work properly. This information provides a detailed list of security vulnerabilities fixed and known issues in the Zimbra Collaboration Kepler 9.0.0 Patch 41 GA release.

Goal Reached Thanks to every supporter — we hit 100%!

Zimbra Collaboration 9.0.0 Patch 41 Security Bulletin: RCE, SSRF, XSS Fixes (CVE-2024-45513, CVE-2024-45519)