{"id":"CVE-2018-6882","title":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 ","published":"2018-03-27T16:29:00.530Z","updated":"2026-10-01T20:17:17.443Z","severity":"medium","cvssScore":6.1,"epss":0.29761,"epssPct":0.98225,"kev":true,"maturity":"weaponized","actionScore":63,"primaryVendor":"synacor","primaryProduct":"zimbra collaboration suite","cweId":"CWE-79","fixAvailable":false,"tags":["pre-auth","xss","remote"],"epssDelta7":0,"summary":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssVersion":"3.1","cvssSource":"nvd-primary","cweName":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","kevAdded":"2022-04-19T00:00:00.000Z","kevDue":"2022-05-10T00:00:00.000Z","kevRansomware":"Known","source":"nvd","cna":"mitre","ssvc":{"exploitation":"active","automatable":"no","impact":"total"},"sources":{"adp":"2026-10-01T19:33:16.504Z","cna":"2026-10-01T19:33:16.504Z","nvd":"2026-10-01T20:17:17Z","epss":"2026-11-12","nuclei":"2026-11-13T03:18:10.620Z","cna_seen":"2026-09-29T10:52:28.191Z"},"cvssCna":{"score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"hasPatchRef":false,"credits":[],"counts":{"exploitdb":0,"metasploit":0,"nuclei":1,"githubPoc":0},"products":[{"vendor":"synacor","product":"zimbra collaboration suite","cpe":"cpe:2.3:a:synacor:zimbra_collaboration_suite"}],"references":[{"url":"http://seclists.org/fulldisclosure/2018/Mar/52","tags":"Mailing List,Third Party Advisory"},{"url":"http://www.securityfocus.com/archive/1/541891/100/0/threaded","tags":"Broken Link,Third Party Advisory,VDB Entry"},{"url":"https://bugzilla.zimbra.com/show_bug.cgi?id=108786","tags":"Broken Link,Issue Tracking,Permissions Required"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7","tags":"Permissions Required"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":"Vendor Advisory"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6882","tags":"US Government Resource"}],"exploits":[{"source":"nuclei","kind":"medium","date":null}],"analysis":null,"affectedVersions":[{"vendor":"synacor","product":"zimbra collaboration suite","version":"*","vsi":null,"vse":null,"vei":null,"vee":"8.7.0"},{"vendor":"synacor","product":"zimbra collaboration suite","version":"8.7.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"synacor","product":"zimbra collaboration suite","version":"8.8.0","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"synacor","product":"zimbra collaboration suite","version":"8.8.1","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"synacor","product":"zimbra collaboration suite","version":"8.8.2","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"synacor","product":"zimbra collaboration suite","version":"8.8.3","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"synacor","product":"zimbra collaboration suite","version":"8.8.4","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"synacor","product":"zimbra collaboration suite","version":"8.8.5","vsi":null,"vse":null,"vei":null,"vee":null},{"vendor":"synacor","product":"zimbra collaboration suite","version":"8.8.6","vsi":null,"vse":null,"vei":null,"vee":null}],"source_attribution":"NVD (NIST), CVE Program, CISA KEV, FIRST EPSS, OSV. Aggregated by Noroxi."}