CVE-2018-6882

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS)

6.1 MEDIUMActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 29.8%

Published27 Mar 2018
Added to CISA KEV19 Apr 2022
Remediation due10 May 2022

Description

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

ScopeChanged

ConfidentialityLow

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Synacor Zimbra Collaboration Suite< 8.7.0 · 8.7.0 · 8.8.0 · 8.8.1

Remediation

Fixed in

Synacor Zimbra Collaboration Suite≥ 8.7.0

Patch & vendor advisories

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

References

https://bugzilla.zimbra.com/show_bug.cgi?id=108786Broken LinkIssue TrackingPermissions Required
http://seclists.org/fulldisclosure/2018/Mar/52Mailing ListThird Party Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7Permissions Required
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6882US Government Resource
https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.htmlExploitThird Party Advisory
http://www.securityfocus.com/archive/1/541891/100/0/threadedBroken LinkThird Party AdvisoryVDB Entry

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2018-6882 being actively exploited?

Yes. CVE-2018-6882 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 19 Apr 2022. It has been used in ransomware campaigns.

How severe is CVE-2018-6882?

CVE-2018-6882 has a CVSS 3.1 base score of 6.1, rated medium. EPSS estimates a 29.8% probability of exploitation.

Which products are affected by CVE-2018-6882?

Affected products include Synacor Zimbra Collaboration Suite.

How do I fix CVE-2018-6882?

Upgrade affected software to a fixed version, for example Synacor Zimbra Collaboration Suite 8.7.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2018-6882 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.