CVE-2018-6882 is a cross-site scripting (XSS) vulnerability affecting Zimbra Collaboration Suite (ZCS) versions before 8.7 Patch 1 and 8.8.x before 8.8.7. This flaw allows remote attackers to inject arbitrary web script or HTML via a crafted Content-Location header in an email attachment. Rated Medium (CVSS 6.1), it requires user interaction but has low attack complexity, potentially leading to client-side information disclosure and integrity compromise. This vulnerability is actively exploited, listed on the CISA KEV catalog, and has a high EPSS score (0.77), indicating a significant likelihood of exploitation. Exploit templates are available, and it has been linked to ransomware campaigns and attacks on government entities, garnering significant community attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 8.7.0CPE matchmatch criteria | cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:* | ||
8.7.0CPE matchmatch criteria | cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.0:-:*:*:*:*:*:* | ||
8.8.0CPE matchmatch criteria | cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.0:*:*:*:*:*:*:* | ||
8.8.1CPE matchmatch criteria | cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.1:*:*:*:*:*:*:* | ||
8.8.2CPE matchmatch criteria | cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.