🔙 목록으로 돌아가기

CVE-2018-6882: Zimbra Collaboration Suite - Cross-site Scripting

TitleZimbra Collaboration Suite - Cross-site Scripting
AuthorSourabh-Sahu
SeverityMedium
ImpactAttackers can execute arbitrary JavaScript in victims' browsers via malicious email attachments, potentially stealing session cookies, credentials, or accessing sensitive email data.
RemediationUpgrade to Zimbra Collaboration Suite version 8.7 Patch 1 or 8.8.7 or later.
CVSS Score6.8
EPSS Score0.61776
CVE IDCVE-2018-6882
CWE IDCWE-79
Tags cve cve2018 smtp zimbra collaboration-server intrusive xss kev vkev

🔍 Vulnerability Description

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.

🌐 HTTP Request

GET /js/zimbraMail/share/model/ZmSettings.js HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/13.0
Connection: close
Content-Length: 64
Content-Type: application/x-www-form-urlencoded
Cookie: ZM_TEST=true
Accept-Encoding: gzip

loginOp=login&username=PmNsEP&password=l8lbKrML&client=preferred

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-6882.yaml

🦈 Packet Capture: ⬇️ Download cve-2018-6882.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A