Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-6882: Zimbra Collaboration Suite lets attackers add malicious web code

CVE-2018-6882 · published 8 years ago · actively exploited

Summary

The Zimbra Collaboration Suite web interface can be tricked into running code that an attacker inserts. This could let an attacker display unwanted content or steal information from users. Update to the latest version of Zimbra Collaboration Suite or apply the provided security patch.

What to do

Update synacor zimbra_collaboration_suite to version 8.7.0 or later.

Affected software

Vendor	Product	Affected versions
synacor	zimbra collaboration suite (zcs)	All versions
synacor	zimbra_collaboration_suite	< 8.7.0 8.7.0 8.8.0 8.8.1 8.8.2 8.8.3 8.8.4 8.8.5 8.8.6 `cpe:2.3:a:synacor:zimbra_collaboration_suite::::::::`

Original advisory text

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.

References

http://seclists.org/fulldisclosure/2018/Mar/52 Mailing List Third Party Advisory
http://www.securityfocus.com/archive/1/541891/100/0/threaded Broken Link Third Party Advisory VDB Entry
https://bugzilla.zimbra.com/show_bug.cgi?id=108786 Broken Link Issue Tracking Permissions Required
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-... US Government Resource
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7 Permissions Required
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-... Exploit Third Party Advisory

Fix within

Internet-facing 3 days

and check for signs of compromise

Internal 14 days

Known to be exploited
Needs hands-on effort to exploit
Gives an attacker full control

Severity

6.1 Medium

Exploitation

Known exploited

Listed in the CISA KEV catalogue - exploitation confirmed in the wild.

30% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published27 Mar 2018

Updated21 Oct 2026

First seen6 Mar 2026

Sources

CVE-2018-6882 · CISA KEV

CVE-2018-6882 · NVD

CVE-2018-6882 · MITRE

CVE-2018-6882 · OSV

Track software like this

Free during beta