PT-2021-20839 · Zimbra · Zimbra Collaboration Suite+1

Published 2021-07-02 · Updated 2023-03-30 · CVE-2021-35207

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.8.0 through 8.8.15 Patch 22 Zimbra Collaboration Suite versions 9.0.0 through 9.0.0 Patch 15

Description: A security issue exists in the login component of Zimbra Web Client, where an attacker can execute arbitrary JavaScript code. This is achieved by adding executable JavaScript to the loginErrorCode parameter of the login URL, specifically the "/api/v1/login" endpoint is not mentioned but the login URL is affected.

Recommendations: For Zimbra Collaboration Suite versions 8.8.0 through 8.8.15 Patch 22, update to version 8.8.15 Patch 23 or later. For Zimbra Collaboration Suite versions 9.0.0 through 9.0.0 Patch 15, update to version 9.0.0 Patch 16 or later. As a temporary workaround, consider restricting access to the login component of the Zimbra Web Client to minimize the risk of exploitation. Avoid using the loginErrorCode parameter in the affected login URL until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-35207

Affected Products

Zimbra Collaboration Suite

Zimbra Web Client

References · 7

• https://osv.dev/vulnerability/CVE-2021-35207 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-35207 · Security Note
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23 · Vendor Advisory
• https://t.me/aptreports/3343 · Telegram Post