Synacor · Zimbra Collaboration Suite (ZCS)
CVE-2018-6882
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
What it is
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 10, 2022
- Added to the CISA list
- April 19, 2022
- Published
- March 27, 2018
- Severity
- Medium 6.1 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 30% in the top 1.8% of all known vulnerabilities
- Weakness
- CWE-79
- More details
- NVD · CVE.org · CISA
All references (6)
- http://seclists.org/fulldisclosure/2018/Mar/52
- https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite…
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7
- https://bugzilla.zimbra.com/show_bug.cgi?id=108786
- http://www.securityfocus.com/archive/1/541891/100/0/threaded
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
More exploited flaws from Synacor
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 21, 2026 | OS Command Injection | Zimbra Collaboration Suite (ZCS) | High 8.9 | 72% |
| Apr 20, 2026 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 1.7% |
| Mar 18, 2026 | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | High 7.2 | 20% |
| Oct 7, 2025 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Medium 5.4 | 4.1% |
| Jul 7, 2025 | Server-Side Request Forgery (SSRF) | Zimbra Collaboration Suite (ZCS) | High 7.5 | 81% |
| May 19, 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 25% |
| Feb 25, 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Critical 9.0 | 77% |
| Oct 3, 2024 | Command Execution | Zimbra Collaboration Suite (ZCS) | Critical 10.0 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.