CVE-2021-35207

high-risk
Published 2021-07-02

An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url.

Do I need to act?

~
1.1% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.1/10 Medium
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Zimbra

References (8)

Release Notes https://wiki.zimbra.com/wiki/Security_Center
Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23
Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16
Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
Release Notes https://wiki.zimbra.com/wiki/Security_Center
Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23
Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16
Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
50
/ 100
high-risk
Severity 23/34 · High
Exploitability 3/34 · Minimal
Exposure 24/34 · High