CVE-2018-6882: Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
First published: Tue Mar 27 2018(Updated: )
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Synacor Zimbra Collaboration Suite | <8.7 | |
| Synacor Zimbra Collaboration Suite | =8.7 | |
| Synacor Zimbra Collaboration Suite | =8.8.0 | |
| Synacor Zimbra Collaboration Suite | =8.8.1 | |
| Synacor Zimbra Collaboration Suite | =8.8.2 | |
| Synacor Zimbra Collaboration Suite | =8.8.3 | |
| Synacor Zimbra Collaboration Suite | =8.8.4 | |
| Synacor Zimbra Collaboration Suite | =8.8.5 | |
| Synacor Zimbra Collaboration Suite | =8.8.6 | |
| Zimbra Collaboration Suite (ZCS) | ||
| <8.7 | ||
| =8.7 | ||
| =8.8.0 | ||
| =8.8.1 | ||
| =8.8.2 | ||
| =8.8.3 | ||
| =8.8.4 | ||
| =8.8.5 | ||
| =8.8.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://seclists.org/fulldisclosure/2018/Mar/52
- http://www.securityfocus.com/archive/1/541891/100/0/threaded
- https://bugzilla.zimbra.com/show_bug.cgi?id=108786
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html
- https://nvd.nist.gov/vuln/detail/CVE-2018-6882
Frequently Asked Questions
What is CVE-2018-6882?
CVE-2018-6882 is a cross-site scripting (XSS) vulnerability in the Zimbra Collaboration Suite (ZCS).
How does the CVE-2018-6882 vulnerability affect Zimbra Collaboration Suite (ZCS)?
The CVE-2018-6882 vulnerability allows remote attackers to inject arbitrary web script or HTML through a Content-Location header in an email attachment in Zimbra Collaboration Suite (ZCS) versions before 8.7 Patch 1 and 8.8.x before 8.8.7.
What is the severity of CVE-2018-6882?
The severity of CVE-2018-6882 is medium with a CVSS score of 6.1.
How can I fix the CVE-2018-6882 vulnerability?
To fix the CVE-2018-6882 vulnerability, update Zimbra Collaboration Suite (ZCS) to version 8.7 Patch 1 or 8.8.7 or later.
Where can I find more information about the CVE-2018-6882 vulnerability?
You can find more information about the CVE-2018-6882 vulnerability at the following references: http://seclists.org/fulldisclosure/2018/Mar/52, http://www.securityfocus.com/archive/1/541891/100/0/threaded, https://bugzilla.zimbra.com/show_bug.cgi?id=108786.
- collector/nvd-index
- agent/softwarecombine
- agent/description
- agent/type
- agent/severity
- agent/title
- agent/weakness
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- exploited/true
- ransomware/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/references
- agent/event
- agent/tags
- collector/nvd-cve
- source/NVD
- vendor/synacor
- canonical/synacor zimbra collaboration suite
- version/synacor zimbra collaboration suite/8.7
- version/synacor zimbra collaboration suite/8.8.0
- version/synacor zimbra collaboration suite/8.8.1
- version/synacor zimbra collaboration suite/8.8.2
- version/synacor zimbra collaboration suite/8.8.3
- version/synacor zimbra collaboration suite/8.8.4
- version/synacor zimbra collaboration suite/8.8.5
- version/synacor zimbra collaboration suite/8.8.6
- vendor/zimbra
- canonical/zimbra collaboration suite (zcs)