Back to CVE Browser

CVE-2018-6882

Known Exploited (CISA KEV)MEDIUM

6.1

CVSS Severity Score

EPSS Score46.7160%

EPSS Percentile98.58th

PublishedMar 27, 2018

Last ModifiedNov 4, 2025

Vulnerability Description

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.

Affected Platforms (CPE)

📦

Synacor

Zimbra Collaboration Suite

< 8.7.0

📦

Synacor

Zimbra Collaboration Suite

= 8.7.0

📦

Synacor

Zimbra Collaboration Suite

= 8.8.0

📦

Synacor

Zimbra Collaboration Suite

= 8.8.1

📦

Synacor

Zimbra Collaboration Suite

= 8.8.2

📦

Synacor

Zimbra Collaboration Suite

= 8.8.3

📦

Synacor

Zimbra Collaboration Suite

= 8.8.4

📦

Synacor

Zimbra Collaboration Suite

= 8.8.5

📦

Synacor

Zimbra Collaboration Suite

= 8.8.6

References & Advisories

🔗 http://seclists.org/fulldisclosure/2018/Mar/52

🔗 http://www.securityfocus.com/archive/1/541891/100/0/threaded

🔗 https://bugzilla.zimbra.com/show_bug.cgi?id=108786

🔗 https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7

🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

🔗 https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html

🔗 http://seclists.org/fulldisclosure/2018/Mar/52

🔗 http://www.securityfocus.com/archive/1/541891/100/0/threaded

Related Vulnerabilities

CVE-2019-96709.8

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnera...

CVE-2018-201609.8

ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other ...

CVE-2019-69809.8

Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.

CVE-2020-77969.8

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.