6.1

CVE-2021-35207

An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zimbra ≫ Collaboration Version >= 8.8 < 8.8.15
Zimbra ≫ Collaboration Version 8.8.15 Update -
Zimbra ≫ Collaboration Version 8.8.15 Update p1
Zimbra ≫ Collaboration Version 8.8.15 Update p10
Zimbra ≫ Collaboration Version 8.8.15 Update p11
Zimbra ≫ Collaboration Version 8.8.15 Update p12
Zimbra ≫ Collaboration Version 8.8.15 Update p13
Zimbra ≫ Collaboration Version 8.8.15 Update p14
Zimbra ≫ Collaboration Version 8.8.15 Update p15
Zimbra ≫ Collaboration Version 8.8.15 Update p16
Zimbra ≫ Collaboration Version 8.8.15 Update p17
Zimbra ≫ Collaboration Version 8.8.15 Update p18
Zimbra ≫ Collaboration Version 8.8.15 Update p19
Zimbra ≫ Collaboration Version 8.8.15 Update p2
Zimbra ≫ Collaboration Version 8.8.15 Update p20
Zimbra ≫ Collaboration Version 8.8.15 Update p21
Zimbra ≫ Collaboration Version 8.8.15 Update p22
Zimbra ≫ Collaboration Version 8.8.15 Update p3
Zimbra ≫ Collaboration Version 8.8.15 Update p4
Zimbra ≫ Collaboration Version 8.8.15 Update p5
Zimbra ≫ Collaboration Version 8.8.15 Update p6
Zimbra ≫ Collaboration Version 8.8.15 Update p7
Zimbra ≫ Collaboration Version 8.8.15 Update p8
Zimbra ≫ Collaboration Version 8.8.15 Update p9
Zimbra ≫ Collaboration Version 9.0.0 Update -
Zimbra ≫ Collaboration Version 9.0.0 Update p1
Zimbra ≫ Collaboration Version 9.0.0 Update p10
Zimbra ≫ Collaboration Version 9.0.0 Update p11
Zimbra ≫ Collaboration Version 9.0.0 Update p12
Zimbra ≫ Collaboration Version 9.0.0 Update p13
Zimbra ≫ Collaboration Version 9.0.0 Update p14
Zimbra ≫ Collaboration Version 9.0.0 Update p15
Zimbra ≫ Collaboration Version 9.0.0 Update p2
Zimbra ≫ Collaboration Version 9.0.0 Update p3
Zimbra ≫ Collaboration Version 9.0.0 Update p4
Zimbra ≫ Collaboration Version 9.0.0 Update p5
Zimbra ≫ Collaboration Version 9.0.0 Update p6
Zimbra ≫ Collaboration Version 9.0.0 Update p7
Zimbra ≫ Collaboration Version 9.0.0 Update p8
Zimbra ≫ Collaboration Version 9.0.0 Update p9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.3% 0.874
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
Vendor Advisory
https://wiki.zimbra.com/wiki/Security_Center
Vendor Advisory
Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23
Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16
Vendor Advisory