CVE-2022-37044
Last modified
CVE-2022-37044 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine.. EPSS estimates a 0.41% chance of exploitation in the next 30 days.
Description
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zimbra | Collaboration | 8.8.15 |
References
- https://wiki.zimbra.com/wiki/Security_CenterPatch, Vendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
- https://wiki.zimbra.com/wiki/Security_CenterPatch, Vendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-37044?
How severe is CVE-2022-37044?
How do I fix CVE-2022-37044?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-37034In dotCMS 5.x-22.06, it is possible to call the TempResource…5.3
- CVE-2022-37035An issue was discovered in bgpd in FRRouting (FRR) 8.3. In b…8.1
- CVE-2022-3704A vulnerability classified as problematic has been found in …5.4
- CVE-2022-37041An issue was discovered in ProxyServlet.java in the /proxy s…7.5
- CVE-2022-37042Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximpo…9.8
- CVE-2022-37043An issue was discovered in the webmail component in Zimbra C…5.7
- CVE-2022-37047The component tcprewrite in Tcpreplay v4.4.1 was discovered …7.8
- CVE-2022-37048The component tcprewrite in Tcpreplay v4.4.1 was discovered …7.8
- CVE-2022-37049The component tcpprep in Tcpreplay v4.4.1 was discovered to …7.8
- CVE-2022-3705A vulnerability was found in vim and classified as problemat…7.5
- CVE-2022-37050In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows a…6.5
- CVE-2022-37051An issue was discovered in Poppler 22.07.0. There is a reach…6.5
Are you affected by CVE-2022-37044?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST