CVE-2018-6882

CVE-2018-6882 is a medium-severity (CVSS 6.1) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). CISA added it to the Known Exploited Vulnerabilities catalog on April 19, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by May 10, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Synacor has 19 vulnerabilities in the KEV catalog, 6 of them linked to ransomware.

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• http://seclists.org/fulldisclosure/2018/Mar/52
• http://www.securityfocus.com/archive/1/541891/100/0/threaded
• https://bugzilla.zimbra.com/show_bug.cgi?id=108786
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html
• http://seclists.org/fulldisclosure/2018/Mar/52
• http://www.securityfocus.com/archive/1/541891/100/0/threaded