CVE-2018-14425

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-05-30 · updated 2026-06-17
Weakness: CWE-79

Description

There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.

Affected products

Zimbra Collaboration: before 8.8.8; 8.8.8, 8.8.8-patch1, 8.8.8-patch3, 8.8.8-patch4, 8.8.9 — fixed in 8.8.8

How to fix

Upgrade to a fixed version: Zimbra Collaboration 8.8.8. Check the vendor advisory for mitigations.

References

https://bugzilla.zimbra.com/show_bug.cgi?id=108970
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://bugzilla.zimbra.com/show_bug.cgi?id=108970
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Get alerted when CVE-2018-14425 or the next vulnerability affects your stack