CVE-2021-35207 is a Cross-Site Scripting (XSS) vulnerability found in Zimbra Collaboration Suite versions 8.8 before Patch 23 and 9.0 before Patch 16. An attacker can exploit this by injecting malicious JavaScript into the loginErrorCode parameter of the Zimbra Web Client's login URL. This vulnerability has a CVSS score of 6.1 (Medium), indicating it can be exploited remotely with low complexity, requiring user interaction, and potentially leading to limited confidentiality and integrity impacts. While there is no public exploit code available (Metasploit, Nuclei, ExploitDB), it has garnered some community discussion and media coverage, with reports of the APT group Winter Vivern exploiting a Zimbra webmail flaw, though it's not confirmed if this specific CVE is the one being leveraged.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 8.8, < 8.8.15CPE matchmatch criteria | cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:* | ||
8.8.15CPE matchmatch criteria | cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:* | ||
8.8.15CPE matchmatch criteria | cpe:2.3:a:zimbra:collaboration:8.8.15:p1:*:*:*:*:*:* | ||
8.8.15CPE matchmatch criteria | cpe:2.3:a:zimbra:collaboration:8.8.15:p10:*:*:*:*:*:* | ||
8.8.15CPE matchmatch criteria | cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.