CVE-2024-33533

Summary

CVE-2024-33533 is a reflected cross-site scripting (XSS) vulnerability affecting Zimbra Collaboration (ZCS) 9.0 and 10.0. The issue lies in the Zimbra webmail admin interface, where inadequate input validation of the packages parameter allows an authenticated attacker to inject and execute arbitrary JavaScript code. By uploading a malicious JavaScript file and crafting a URL with its location in the packages parameter, an attacker can exploit this vulnerability, leading to the execution of the malicious code in another user's browser session.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.