Actively exploited · Published Mar 27, 2018 · Assigned by mitre
CVE-2018-6882
Medium 6.1 Exploited Ransomware
In plain English
A medium-severity cross-site scripting in Zimbra Collaboration Suite (ZCS) from Synacor. Attackers are actively exploiting it in the wild (listed by CISA on April 19, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 29.8% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by May 10, 2022.
Official description
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- 20180324 Cross-Site Scripting vulnerability in Zimbra Collaboration Suite due to the way it handles attachment links mailing-list, x_refsource_FULLDISC
- https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html x_refsource_MISC
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7 x_refsource_CONFIRM
- https://bugzilla.zimbra.com/show_bug.cgi?id=108786 x_refsource_CONFIRM
- 20180324 Cross-Site Scripting vulnerability in Zimbra Collaboration Suite due to the way it handles attachment links mailing-list, x_refsource_BUGTRAQ
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6882 government-resource