Lucene search

[email protected]CVE-2021-35208

HistoryJul 02, 2021 - 7:15 p.m.

CVE-2021-35208

2021-07-0219:15:08

CWE-79

[email protected]

web.nvd.nist.gov

173

cve-2021-35208

zmmailmsgview.js

zimbra collaboration suite

html injection

javascript

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

AI Score

6.2

Confidence

High

EPSS

0.002

Percentile

51.9%

JSON

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Affected configurations

NVD

Node

zimbracollaborationRange8.8–8.8.15

zimbracollaborationMatch8.8.15-

zimbracollaborationMatch8.8.15p1

zimbracollaborationMatch8.8.15p10

zimbracollaborationMatch8.8.15p11

zimbracollaborationMatch8.8.15p12

zimbracollaborationMatch8.8.15p13

zimbracollaborationMatch8.8.15p14

zimbracollaborationMatch8.8.15p15

zimbracollaborationMatch8.8.15p16

zimbracollaborationMatch8.8.15p17

zimbracollaborationMatch8.8.15p18

zimbracollaborationMatch8.8.15p19

zimbracollaborationMatch8.8.15p2

zimbracollaborationMatch8.8.15p20

zimbracollaborationMatch8.8.15p21

zimbracollaborationMatch8.8.15p22

zimbracollaborationMatch8.8.15p3

zimbracollaborationMatch8.8.15p4

zimbracollaborationMatch8.8.15p5

zimbracollaborationMatch8.8.15p6

zimbracollaborationMatch8.8.15p7

zimbracollaborationMatch8.8.15p8

zimbracollaborationMatch8.8.15p9

VendorProductVersionCPE
zimbracollaboration8.8.15cpe:/a:zimbra:collaboration:8.8.15:p16::
zimbracollaboration8.8.15cpe:/a:zimbra:collaboration:8.8.15:p5::
zimbracollaboration8.8.15cpe:/a:zimbra:collaboration:8.8.15:p11::
zimbracollaboration8.8.15cpe:/a:zimbra:collaboration:8.8.15:p12::
zimbracollaboration8.8.15cpe:/a:zimbra:collaboration:8.8.15:p7::
zimbracollaboration8.8.15cpe:/a:zimbra:collaboration:8.8.15:p15::
zimbracollaboration8.8.15cpe:/a:zimbra:collaboration:8.8.15:p19::
zimbracollaboration8.8.15cpe:/a:zimbra:collaboration:8.8.15:p6::
zimbracollaboration8.8.15cpe:/a:zimbra:collaboration:8.8.15:p2::
zimbracollaboration8.8.15cpe:/a:zimbra:collaboration:8.8.15:p4::

Vendor	Product	Version	CPE
zimbra	collaboration	8.8.15	cpe:/a:zimbra:collaboration:8.8.15:p16::
zimbra	collaboration	8.8.15	cpe:/a:zimbra:collaboration:8.8.15:p5::
zimbra	collaboration	8.8.15	cpe:/a:zimbra:collaboration:8.8.15:p11::
zimbra	collaboration	8.8.15	cpe:/a:zimbra:collaboration:8.8.15:p12::
zimbra	collaboration	8.8.15	cpe:/a:zimbra:collaboration:8.8.15:p7::
zimbra	collaboration	8.8.15	cpe:/a:zimbra:collaboration:8.8.15:p15::
zimbra	collaboration	8.8.15	cpe:/a:zimbra:collaboration:8.8.15:p19::
zimbra	collaboration	8.8.15	cpe:/a:zimbra:collaboration:8.8.15:p6::
zimbra	collaboration	8.8.15	cpe:/a:zimbra:collaboration:8.8.15:p2::
zimbra	collaboration	8.8.15	cpe:/a:zimbra:collaboration:8.8.15:p4::