Lucene search

[email protected]NVD:CVE-2021-35207

HistoryJul 02, 2021 - 7:15 p.m.

CVE-2021-35207

2021-07-0219:15:08

CWE-79

[email protected]

web.nvd.nist.gov

zimbra collaboration suite

xss vulnerability

zimbra web client

javascript execution

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

44.3%

JSON

An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url.

Affected configurations

Nvd

Node

zimbracollaborationRange8.8–8.8.15

zimbracollaborationMatch8.8.15-

zimbracollaborationMatch8.8.15p1

zimbracollaborationMatch8.8.15p10

zimbracollaborationMatch8.8.15p11

zimbracollaborationMatch8.8.15p12

zimbracollaborationMatch8.8.15p13

zimbracollaborationMatch8.8.15p14

zimbracollaborationMatch8.8.15p15

zimbracollaborationMatch8.8.15p16

zimbracollaborationMatch8.8.15p17

zimbracollaborationMatch8.8.15p18

zimbracollaborationMatch8.8.15p19

zimbracollaborationMatch8.8.15p2

zimbracollaborationMatch8.8.15p20

zimbracollaborationMatch8.8.15p21

zimbracollaborationMatch8.8.15p22

zimbracollaborationMatch8.8.15p3

zimbracollaborationMatch8.8.15p4

zimbracollaborationMatch8.8.15p5

zimbracollaborationMatch8.8.15p6

zimbracollaborationMatch8.8.15p7

zimbracollaborationMatch8.8.15p8

zimbracollaborationMatch8.8.15p9

zimbracollaborationMatch9.0.0-

zimbracollaborationMatch9.0.0p1

zimbracollaborationMatch9.0.0p10

zimbracollaborationMatch9.0.0p11

zimbracollaborationMatch9.0.0p12

zimbracollaborationMatch9.0.0p13

zimbracollaborationMatch9.0.0p14

zimbracollaborationMatch9.0.0p15

zimbracollaborationMatch9.0.0p2

zimbracollaborationMatch9.0.0p3

zimbracollaborationMatch9.0.0p4

zimbracollaborationMatch9.0.0p5

zimbracollaborationMatch9.0.0p6

zimbracollaborationMatch9.0.0p7

zimbracollaborationMatch9.0.0p8

zimbracollaborationMatch9.0.0p9

VendorProductVersionCPE
zimbracollaboration*cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*
zimbracollaboration8.8.15cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*
zimbracollaboration8.8.15cpe:2.3:a:zimbra:collaboration:8.8.15:p1:*:*:*:*:*:*
zimbracollaboration8.8.15cpe:2.3:a:zimbra:collaboration:8.8.15:p10:*:*:*:*:*:*
zimbracollaboration8.8.15cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:*
zimbracollaboration8.8.15cpe:2.3:a:zimbra:collaboration:8.8.15:p12:*:*:*:*:*:*
zimbracollaboration8.8.15cpe:2.3:a:zimbra:collaboration:8.8.15:p13:*:*:*:*:*:*
zimbracollaboration8.8.15cpe:2.3:a:zimbra:collaboration:8.8.15:p14:*:*:*:*:*:*
zimbracollaboration8.8.15cpe:2.3:a:zimbra:collaboration:8.8.15:p15:*:*:*:*:*:*
zimbracollaboration8.8.15cpe:2.3:a:zimbra:collaboration:8.8.15:p16:*:*:*:*:*:*

Vendor	Product	Version	CPE
zimbra	collaboration	*	cpe:2.3:a:zimbra:collaboration::::::::
zimbra	collaboration	8.8.15	cpe:2.3:a:zimbra:collaboration:8.8.15:-::::::
zimbra	collaboration	8.8.15	cpe:2.3:a:zimbra:collaboration:8.8.15:p1::::::
zimbra	collaboration	8.8.15	cpe:2.3:a:zimbra:collaboration:8.8.15:p10::::::
zimbra	collaboration	8.8.15	cpe:2.3:a:zimbra:collaboration:8.8.15:p11::::::
zimbra	collaboration	8.8.15	cpe:2.3:a:zimbra:collaboration:8.8.15:p12::::::
zimbra	collaboration	8.8.15	cpe:2.3:a:zimbra:collaboration:8.8.15:p13::::::
zimbra	collaboration	8.8.15	cpe:2.3:a:zimbra:collaboration:8.8.15:p14::::::
zimbra	collaboration	8.8.15	cpe:2.3:a:zimbra:collaboration:8.8.15:p15::::::
zimbra	collaboration	8.8.15	cpe:2.3:a:zimbra:collaboration:8.8.15:p16::::::

Rows per page:

1-10 of 401

References

wiki.zimbra.com/wiki/Security_Center

wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23

wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16

wiki.zimbra.com/wiki/Zimbra_Security_Advisories

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

44.3%

JSON

Related for NVD:CVE-2021-35207

prion1 osv1 cve1 cvelist1 nessus1