PT-2018-3811 · Zimbra · Zimbra Collaboration Suite

Stephan Kaag · Published 2018-01-01 · Updated 2025-11-04 · CVE-2018-6882

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite (ZCS) versions 8.7 before Patch 1 through 8.8.x before 8.8.7

Description The issue is related to a cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function. This vulnerability might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment. The exploitation of this vulnerability can enable a remote attacker to execute arbitrary code by sending a specially crafted email containing a Content-Location header.

Recommendations For Zimbra Collaboration Suite (ZCS) versions 8.7 before Patch 1, update to at least Patch 1. For Zimbra Collaboration Suite (ZCS) versions 8.8.x before 8.8.7, update to at least version 8.8.7. As a temporary workaround, consider restricting access to email attachments with Content-Location headers until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2022-04979

CVE-2018-6882

Affected Products

Zimbra Collaboration Suite

References · 18

• 🔥 https://securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html · Exploit
• 🔥 https://packetstormsecurity.com/files/146888/Zimbra-Collaboration-Suite-8.7.11_GA_1854-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-6882 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6882 · Security Note
• https://bdu.fstec.ru/vul/2022-04979 · Security Note
• http://seclists.org/fulldisclosure/2018/Mar/52 · Note
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7 · Note
• https://t.me/cvenotify/108712 · Telegram Post
• https://t.me/cvenotify/112366 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6882 · Note
• https://bugzilla.zimbra.com/show_bug.cgi?id=108786 · Note
• https://t.me/cvenotify/110422 · Telegram Post
• https://t.me/cveNotify/132521 · Telegram Post
• http://securityfocus.com/archive/1/541891/100/0/threaded · Note