CVEvulnerability

CVE-2018-6882

6.1 MEDIUM Known exploited Published 2018-03-27 Modified 2026-10-01 Official page ↗

CISA Known Exploited Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability — Synacor Zimbra Collaboration Suite (ZCS)

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.

Added to KEV
2022-04-19
Remediation due
2022-05-10
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2018-6882
Status
Analyzed
Published
2018-03-27
Last modified
2026-10-01
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-79

Description

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.

Affected configurations

• synacor zimbra collaboration suite (< 8.7.0) • synacor zimbra collaboration suite 8.7.0 • synacor zimbra collaboration suite 8.8.0 • synacor zimbra collaboration suite 8.8.1 • synacor zimbra collaboration suite 8.8.2 • synacor zimbra collaboration suite 8.8.3 • synacor zimbra collaboration suite 8.8.4 • synacor zimbra collaboration suite 8.8.5 • synacor zimbra collaboration suite 8.8.6

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References