{"id":"CVE-2023-24031","details":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 8.8.15. XSS can occur, via one of attributes of the webmail /h/ endpoint, to execute arbitrary JavaScript code, leading to information disclosure.","modified":"2026-08-12T03:51:30.721656306Z","published":"2023-06-15T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24031.json"},"references":[{"type":"WEB","url":"https://wiki.zimbra.com/wiki/Security_Center"},{"type":"WEB","url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/24xxx/CVE-2023-24031.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-24031"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/zimbra/zm-build","events":[{"introduced":"b6cd8f69d2761c014d4a3807f0bdee0011386444"},{"last_affected":"b20d016c829af1c0ffbaa0545c1deb96ccd5e2e5"}],"database_specific":{"extracted_events":[{"introduced":"9.0.0-NA"},{"last_affected":"9.0.0-NA"},{"introduced":"9.0.0-p0"},{"last_affected":"9.0.0-p0"},{"introduced":"9.0.0-p1"},{"last_affected":"9.0.0-p1"},{"introduced":"9.0.0-p19"},{"last_affected":"9.0.0-p19"},{"introduced":"9.0.0-p23"},{"last_affected":"9.0.0-p23"},{"introduced":"9.0.0-p25"},{"last_affected":"9.0.0-p25"},{"introduced":"9.0.0-p26"},{"last_affected":"9.0.0-p26"},{"introduced":"9.0.0-p27"},{"last_affected":"9.0.0-p27"},{"introduced":"9.0.0-p4"},{"last_affected":"9.0.0-p4"},{"introduced":"9.0.0-p7"},{"last_affected":"9.0.0-p7"},{"introduced":"9.0.0-p7\\.1"},{"last_affected":"9.0.0-p7\\.1"}],"source":"CPE_STRING","cpe":["cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*","cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*","cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*","cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*","cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*","cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*","cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*","cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*","cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*","cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*","cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*"]}}],"versions":["9.0.0-NA","9.0.0-p0","9.0.0-p1","9.0.0-p23","9.0.0-p25","9.0.0-p26","9.0.0-p27","9.0.0-p4","9.0.0-p7","9.0.0-p7\\.1","9.0.0","9.0.0.p7.1","9.0.0.p7","9.0.0.p4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-24031.json"}}],"schema_version":"1.9.0"}