CVE-2018-20160: XEE
Published May 29, 2019
·Updated
ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.
Affected Software
25 affected components
Synacor Zimbra Collaboration Suite>=8.7.0<8.7.11
Synacor Zimbra Collaboration Suite>=8.8.0<8.8.9
Synacor Zimbra Collaboration Suite=8.7.11
Synacor Zimbra Collaboration Suite=8.7.11-p1
Synacor Zimbra Collaboration Suite=8.7.11-p2
Synacor Zimbra Collaboration Suite=8.7.11-p3
Synacor Zimbra Collaboration Suite=8.7.11-p4
Synacor Zimbra Collaboration Suite=8.7.11-p5
Synacor Zimbra Collaboration Suite=8.7.11-p6
Synacor Zimbra Collaboration Suite=8.7.11-p7
Synacor Zimbra Collaboration Suite=8.7.11-p8
Synacor Zimbra Collaboration Suite=8.7.11-p9
Synacor Zimbra Collaboration Suite=8.8.9
Synacor Zimbra Collaboration Suite=8.8.9-p1
Synacor Zimbra Collaboration Suite=8.8.9-p2
Synacor Zimbra Collaboration Suite=8.8.9-p3
Synacor Zimbra Collaboration Suite=8.8.9-p4
Synacor Zimbra Collaboration Suite=8.8.9-p6
Synacor Zimbra Collaboration Suite=8.8.9-p7
Synacor Zimbra Collaboration Suite=8.8.9-p8
Synacor Zimbra Collaboration Suite=8.8.10
Synacor Zimbra Collaboration Suite=8.8.10-p2
Synacor Zimbra Collaboration Suite=8.8.10-p3
Synacor Zimbra Collaboration Suite=8.8.10-p4
Synacor Zimbra Collaboration Suite=8.8.11
Event History
May 29, 2019
CVE Published
via MITRE·09:12 PM
Data Sourced
via MITRE·09:12 PM
Description
Frequently Asked Questions
1
What is CVE-2018-20160?
CVE-2018-20160 is a vulnerability in ZxChat (aka ZeXtras Chat) that allows XXE attacks.
2
How does CVE-2018-20160 affect Synacor Zimbra Collaboration Suite?
CVE-2018-20160 affects Synacor Zimbra Collaboration Suite 8.7 and 8.8, allowing XXE attacks.
3
What is the severity of CVE-2018-20160?
The severity of CVE-2018-20160 is rated as critical with a CVSS score of 9.8.
4
How can I fix the CVE-2018-20160 vulnerability?
To fix the CVE-2018-20160 vulnerability, update to a version of Synacor Zimbra Collaboration Suite that is not affected by the vulnerability.
5
Where can I find more information about CVE-2018-20160?
You can find more information about CVE-2018-20160 on the Zimbra Bugzilla and Zimbra Security Advisories websites.