CVE-2020-13653

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-02 · updated 2026-06-17
Weakness: CWE-79

Description

An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature.

Affected products

Zimbra Collaboration: before 8.8.15; 8.8.15, 8.8.15-p1, 8.8.15-p10, 8.8.15-p2, 8.8.15-p3, 8.8.15-p4 (+5) — fixed in 8.8.15

How to fix

Upgrade to a fixed version: Zimbra Collaboration 8.8.15. Check the vendor advisory for mitigations.

References

https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P11
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P4
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P11
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P4
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Get alerted when CVE-2020-13653 or the next vulnerability affects your stack