Vulnerability Details : CVE-2018-6882
Used for ransomware!
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
Vulnerability category: Cross site scripting (XSS)
Products affected by CVE-2018-6882
- cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.4:*:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.6:*:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7:-:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.2:*:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.3:*:*:*:*:*:*:*
- cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.5:*:*:*:*:*:*:*
CVE-2018-6882 is in the CISA Known Exploited Vulnerabilities Catalog
This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2018-6882
Added on
2022-04-19
Action due date
2022-05-10
Exploit prediction scoring system (EPSS) score for CVE-2018-6882
0.75%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 79 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-6882
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
6.1
|
MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2018-6882
-
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.Assigned by: nvd@nist.gov (Primary)
References for CVE-2018-6882
-
https://bugzilla.zimbra.com/show_bug.cgi?id=108786
Access DeniedIssue Tracking
-
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7
Zimbra Releases/8.8.7 - Zimbra :: Tech CenterPermissions Required
-
http://seclists.org/fulldisclosure/2018/Mar/52
Full Disclosure: Cross-Site Scripting vulnerability in Zimbra Collaboration Suite due to the way it handles attachment linksMailing List;Third Party Advisory
-
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
Zimbra Security Advisories - Zimbra :: Tech CenterVendor Advisory
-
https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html
Cross-Site Scripting vulnerability in Zimbra Collaboration Suite due to the way it handles attachment links - Security Advisories and Insights - Securify B.V.Exploit;Third Party Advisory
-
http://www.securityfocus.com/archive/1/541891/100/0/threaded
SecurityFocusThird Party Advisory;VDB Entry
Jump to