Synacor · Zimbra Collaboration Suite (ZCS)
CVE-2018-6882
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Nedir
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 10 Mayıs 2022
- CISA listesine eklenme
- 19 Nisan 2022
- Yayımlanma
- 27 Mart 2018
- Önem
- Orta 6,1 CVSS 3.1
- Önümüzdeki 30 günde saldırı olasılığı (EPSS)
- 30% bilinen tüm açıkların en üstteki 1,8% diliminde
- Zayıflık
- CWE-79
- Daha fazla ayrıntı
- NVD · CVE.org · CISA
Tüm kaynaklar (6)
- http://seclists.org/fulldisclosure/2018/Mar/52
- https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite…
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7
- https://bugzilla.zimbra.com/show_bug.cgi?id=108786
- http://www.securityfocus.com/archive/1/541891/100/0/threaded
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
Synacor için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 21 Ağu 2026 | OS Command Injection | Zimbra Collaboration Suite (ZCS) | Yüksek 8,9 | 72% |
| 20 Nis 2026 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Orta 6,1 | 1,7% |
| 18 Mar 2026 | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | Yüksek 7,2 | 20% |
| 7 Eki 2025 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Orta 5,4 | 4,1% |
| 7 Tem 2025 | Server-Side Request Forgery (SSRF) | Zimbra Collaboration Suite (ZCS) | Yüksek 7,5 | 81% |
| 19 May 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Orta 6,1 | 25% |
| 25 Şub 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Kritik 9,0 | 77% |
| 3 Eki 2024 | Command Execution | Zimbra Collaboration Suite (ZCS) | Kritik 10,0 | 99,9% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.