CVE-2022-41350: 
Zimbra Collaboration Server vulnerability analysis and mitigation

In Zimbra Collaboration Suite (ZCS) 8.8.15, /h/search?action=voicemail&action=listen accepts a phone parameter that is vulnerable to Reflected XSS. This vulnerability was discovered and disclosed in September 2022 and affects the search functionality in ZCS version 8.8.15 (MITRE).

The vulnerability exists in the voicemail search functionality of Zimbra Collaboration Suite, specifically at the endpoint /h/search?action=voicemail&action=listen. The issue stems from insufficient sanitization of the 'phone' parameter, which allows for the injection of malicious JavaScript code. When this parameter is processed by the application, the malicious code gets reflected back to users, enabling cross-site scripting attacks (MITRE, Zimbra Security).

The vulnerability allows attackers to execute arbitrary JavaScript code on victims' machines when they access the affected search functionality. This can lead to session hijacking, theft of sensitive information, and potential manipulation of the web application's content (MITRE).

The vulnerability can be exploited by crafting a specific URL with a malicious payload in the 'phone' parameter. When a user accesses this URL while authenticated to the Zimbra system, the malicious JavaScript code executes in their browser context (MITRE).

The vulnerability was addressed in Zimbra Collaboration Suite 8.8.15 Patch 34. Organizations should upgrade to this or a later version to protect against this vulnerability (Zimbra Security).