Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

MEDIUM 6.1EXPLOITED (CISA KEV)CVE-2018-6882 · Published 27/03/2018 · updated 01/10/2026

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 19/04/2022. Patch affected systems as an emergency. It is known to be used in ransomware campaigns.

Package	Affected versions	Patched versions
zimbra collaboration suite synacor	`= 8.7.0= 8.8.0= 8.8.1= 8.8.2= 8.8.3= 8.8.4= 8.8.5= 8.8.6< 8.7.0`	`8.7.0`

Description

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.

References

seclists.org/fulldisclosure/2018/Mar/52 · Mailing List
securityfocus.com/archive/1/541891/100/0/threaded · Broken Link
bugzilla.zimbra.com/show_bug.cgi · Broken Link
wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7 · Permissions Required
wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2018-6882

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free