Actively exploited in the wild

Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Synacor - Zimbra Collaboration Suite (ZCS) · Listed in the CISA KEV since 2022-04-19. This indicates confirmed attacks in production environments.

Required action: Apply updates per vendor instructions.

CVE-2018-6882

MediumCVSS 6.1KEV

Published: 27/03/2018(UTC)Updated: 13/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

25.42%

98th percentile - higher than 98% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability in ZmMailMsgView.getAttachmentLinkHtml in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7. Remote attackers can inject arbitrary web script or HTML via a Content-Location header in an email attachment.

Risk Assessment

An attacker could exploit XSS to steal user sessions, take over accounts, or spread malware within the Zimbra environment.

Recommendation

Update Zimbra Collaboration Suite to version 8.7 Patch 1 or later (for 8.7) and 8.8.7 or later (for 8.8.x).

Original NVD description (English source)

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.