CVE-2017-8802

Severity: medium (CVSS 5.4 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-01-16 · updated 2026-06-17
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality.

Affected products

Synocor Zimbra Collaboration Suite: through 8.7.11; 8.8.0-beta1

References

http://www.securityfocus.com/archive/1/541661/100/0/threaded
https://bugzilla.zimbra.com/show_bug.cgi?id=107925
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-001_zimbra_stored_xss.txt
http://www.securityfocus.com/archive/1/541661/100/0/threaded
https://bugzilla.zimbra.com/show_bug.cgi?id=107925
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://www.compass-security.com/fileadmin/Datein/Research/Advisories/CSNC-2018-001_zimbra_stored_xss.txt

Get alerted when CVE-2017-8802 or the next vulnerability affects your stack