CVE-2021-35208

2021-07-0218:54:54

mitre

www.cve.org

zmmailmsgview.js

calendar invite component

zimbra collaboration suite 8.8.x before 8.8.15 patch 23

html injection

executable javascript

arbitrary markup

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

51.9%

JSON

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.