What’s Vulnerable › Vulnerabilities

CVE-2018-10939

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-05-30 · updated 2026-06-17
• Weakness: CWE-79

Description

Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.

Affected products

• Zimbra Collaboration: from 8.7.0 through 8.7.11; from 8.8.0 through 8.8.8; 8.7.11-p1, 8.7.11-p2, 8.7.11-p3, 8.8.8-p1, 8.8.8-p3
• Zimbra Collaboration Suite: 8.8.8-p2

References

• https://blog.zimbra.com/2018/05/new-zimbra-patches-8-8-8-patch-4-and-8-7-11-patch-4/
• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P4
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.8/P4
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://blog.zimbra.com/2018/05/new-zimbra-patches-8-8-8-patch-4-and-8-7-11-patch-4/
• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.7.11/P4
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.8/P4
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Get alerted when CVE-2018-10939 or the next vulnerability affects your stack