CVE-2018-6882: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: yes — in CISA KEV since 2022-04-19
EPSS: 29.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-03-27 · updated 2026-10-01
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.

Affected products

Zimbra Collaboration: before 8.7.0; 8.7.0, 8.8.0, 8.8.1, 8.8.2, 8.8.3, 8.8.4 (+2) — fixed in 8.7.0

How to fix

Upgrade to a fixed version: Zimbra Collaboration 8.7.0. Check the vendor advisory for mitigations.

References

http://seclists.org/fulldisclosure/2018/Mar/52
http://www.securityfocus.com/archive/1/541891/100/0/threaded
https://bugzilla.zimbra.com/show_bug.cgi?id=108786
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html
http://seclists.org/fulldisclosure/2018/Mar/52
http://www.securityfocus.com/archive/1/541891/100/0/threaded
https://bugzilla.zimbra.com/show_bug.cgi?id=108786
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html

Get alerted when CVE-2018-6882 or the next vulnerability affects your stack