CVE-2018-6882Medium· 6.1▾ Midnight⚠ Exploited in the wildPoC availableCross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTM…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 33.6 · likelihood 6 · exploitation 25 · ransomware 5
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Aug 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Federal remediation due May 10, 2022
25%
Nuclei ×1
25% → 30%
Last analysed / modified upstream
Added to the CISA catalog on Apr 19, 2022. Federal remediation due May 10, 2022. View catalog ↗
Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.
zimbra_collaboration_suite < 8.7.0zimbra_collaboration_suite = 8.7.0zimbra_collaboration_suite = 8.8.0zimbra_collaboration_suite = 8.8.1zimbra_collaboration_suite = 8.8.2zimbra_collaboration_suite = 8.8.3zimbra_collaboration_suite = 8.8.4zimbra_collaboration_suite = 8.8.5zimbra_collaboration_suite = 8.8.6Upgrade past the affected range:
zimbra_collaboration_suite 8.7.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2022-41352Critical· 9.8An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0
CVE-2022-27925High· 7.2Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it
CVE-2022-27924High· 7.5Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance
CVE-2022-24682Medium· 6.1An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021
CVE-2022-37042Critical· 9.8Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it
CVE-2025-66376High· 7.2Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTML e-mail message.