CVE-2017-8802 Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show...
MediumCVSS 5.4
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (aka ZCS) before 8.8.0 Beta2 might allow remote attackers to inject arbitrary web script or HTML via vectors related to the "Show Snippet" functionality.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| synocor zimbra collaboration suite | <= 8.7.11 | No fix listed |
| synocor zimbra collaboration suite | = 8.8.0-beta1 | No fix listed |
References
- 20180111 CVE-2017-8802 Zimbra Collaboration Suite - Stored Cross-Site Scripting mailing-list
- bugzilla.zimbra.com permissions-required
- wiki.zimbra.com patch vendor-advisory
- www.compass-security.com third-party-advisory