CVE-2018-6882
KEVRansomware UseSynacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Description
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NPublishedMar 27, 2018
Last modifiedOct 1, 2026
Added to KEVApr 19, 2022
Remediation dueMay 10, 2022
References
- seclists.org/fulldisclosure/2018/Mar/52Mailing ListThird Party Advisory
- securityfocus.com/archive/1/541891/100/0/threadedBroken LinkThird Party Advisory
- bugzilla.zimbra.com/show_bug.cgi?id=108786Broken LinkIssue Tracking
- wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7Permissions Required
- wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
- securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.htmlExploitThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6882US Government Resource
0 recent articles mention this CVE
73
Risk assessment · High
Actively exploited and used by ransomware crews. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1631 days
- Ransomware
- Used in known ransomware campaigns
- CVSS
- 6.1 MEDIUM
- EPSS (30-day exploit probability)
- 29.8% · top 2% of all CVEs
- Weakness
- CWE-79
- Attack vector
- Network, remotely reachable
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
- 5.Verify offline/immutable backups and segment the affected systems. This flaw is used for ransomware initial access.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.