CVE-2020-11737: XSS
A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring (including the quotes) followed immediately by a DOM event listener such as onmouseover. This is fixed in 9.0.0 Patch 2.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-11737?
CVE-2020-11737 is a cross-site scripting (XSS) vulnerability in Zimbra 9.0 Web Client.
What is the severity of CVE-2020-11737?
The severity of CVE-2020-11737 is medium with a CVSS score of 6.1.
How does CVE-2020-11737 affect Zimbra Collaboration (ZCS) 9.0.0?
CVE-2020-11737 affects Zimbra Collaboration (ZCS) 9.0.0, allowing a remote attacker to execute arbitrary JavaScript by crafting links in an E-Mail message or calendar invite.
How can I fix CVE-2020-11737?
To fix CVE-2020-11737, update to Zimbra Collaboration (ZCS) 9.0.0 Patch 2 or later.
Where can I find more information about CVE-2020-11737?
More information about CVE-2020-11737 can be found in the following references: - [Zimbra Blog](https://blog.zimbra.com/2020/05/new-zimbra-9-kepler-patch-2/) - [Zimbra Wiki](https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P2) - [Zimbra Security Advisories](https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories)