{"id":"CVE-2018-6882","aliases":["EUVD-2018-18627","GHSA-3rrv-gxmq-5643"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in...","description":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.29761,"percentile":0.98209,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2018-03-27T16:00:00Z","modified":"2026-10-24T10:31:01Z","kev":{"date_added":"2022-04-19","due_date":"2022-05-10","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2022-04-19"},{"source":"kev","since":"2022-04-19"}],"exploits":[{"source":"nuclei","id":"CVE-2018-6882","title":"Zimbra Collaboration Suite - Cross-site Scripting","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6882.yaml"}],"products":[{"vendor":"synacor","product":"zimbra collaboration suite (zcs)"},{"vendor":"synacor","product":"zimbra_collaboration_suite"}],"references":[{"url":"http://seclists.org/fulldisclosure/2018/Mar/52","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7","tags":["x_refsource_CONFIRM","x_transferred","Permissions Required","report"]},{"url":"https://bugzilla.zimbra.com/show_bug.cgi?id=108786","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","Issue Tracking","Permissions Required","report"]},{"url":"http://www.securityfocus.com/archive/1/541891/100/0/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Broken Link","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6882","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-6882"},{"url":"https://github.com/advisories/GHSA-3rrv-gxmq-5643"}],"sources":{"cve":[{"id":"CVE-2018-6882","description":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.","status":"published","published":"2018-03-27T16:00:00Z","modified":"2026-10-01T19:33:16.504Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:05.961936Z"}],"euvd":[{"id":"EUVD-2018-18627","description":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.","status":"published","published":"2018-03-27T16:00:00Z","modified":"2026-10-01T19:33:16Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"exploited_since":"2022-04-19","updated_at":"2026-11-02T17:27:43.593551Z"}],"ghsa":[{"id":"GHSA-3rrv-gxmq-5643","title":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in...","description":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.","status":"published","published":"2022-05-14T01:28:46Z","modified":"2025-10-22T00:32:32Z","cvss":[{"version":"3.0","score":6.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:05.954742Z"}],"kev":[{"id":"CVE-2018-6882","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","description":"Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.","cwes":["CWE-79"],"kev":{"date_added":"2022-04-19","due_date":"2022-05-10","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2018-6882","description":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.","status":"published","published":"2018-03-27T16:29:00.53Z","modified":"2026-10-01T20:17:17.443Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"CVE-2018-6882","description":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.","status":"published","published":"2018-03-27T16:29:00.53Z","modified":"2026-10-24T10:31:01.601116476Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.74357Z"}]}}