CVE-2022-41349: 
Zimbra Collaboration Server vulnerability analysis and mitigation

In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/compose accepts an attachUrl parameter that is vulnerable to Reflected XSS. This vulnerability, identified as CVE-2022-41349, was discovered and reported by Tin Pham aka TF1T of VietSunshine Cyber Security Services (Zimbra Security).

The vulnerability exists in the compose functionality of Zimbra Collaboration Suite's webmail interface, specifically at the /h/compose endpoint. The attachUrl parameter is not properly sanitized, allowing for the injection of malicious JavaScript code. This reflected XSS vulnerability has a CVSS score of 6.1, indicating a medium severity level (Zimbra Security).

When successfully exploited, this vulnerability allows executing arbitrary JavaScript code on the victim's machine. This could potentially lead to session hijacking, data theft, or other malicious actions performed in the context of the authenticated user's session (CVE Details).

The vulnerability requires user interaction and can be exploited by crafting a specific URL with malicious JavaScript code in the attachUrl parameter. An attacker would need to convince a user to click on or visit a specially crafted URL to trigger the exploit (CVE Details).

The vulnerability was addressed in Zimbra Collaboration Suite 8.8.15 Patch 34. Organizations running affected versions should upgrade to the patched version to mitigate this security risk (Zimbra Security).