CVE-2018-6882

MediumCVSS 6.1/10Known exploited (CISA KEV)Last modified Oct 1, 2026

Description

Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2018
Last modified
Oct 1, 2026
Added to CISA KEV
Apr 19, 2022
NVD status
Analyzed

Related CVEs from 2018

CVE-2018-68834.9Piwigo before 2.9.3 has SQL injection in admin/tags.php in the administration panel, via the tags array parameter in an admin.php?page=tags CVE-2018-68859.8An issue was discovered in MicroStrategy Web Services (the Microsoft Office plugin) before 10.4 Hotfix 7, and before 10.11. The vulnerabilitCVE-2018-68888.0An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgCVE-2018-68898.8An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can poCVE-2018-68904.8Cross-site scripting (XSS) vulnerability in Wolf CMS 0.8.3.1 via the page editing feature, as demonstrated by /?/admin/page/edit/3.CVE-2018-68916.1Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.CVE-2018-68929.8An issue was discovered in CloudMe before 1.11.0. An unauthenticated remote attacker that can connect to the "CloudMe Sync" client applicatiCVE-2018-68939.8controllers/member/Api.php in dayrui FineCms 5.2.0 has SQL Injection: a request with s=member,c=api,m=checktitle, and the parameter 'module'CVE-2018-69005.4PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page.CVE-2018-69025.4PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action.CVE-2018-69038.8PHP Scripts Mall Hot Scripts Clone Script Classified v3.1 uses the client side to enforce validation of an e-mail address, which allows remoCVE-2018-69045.4PHP Scripts Mall Car Rental Script 2.0.8 has XSS via the User Name field in an Edit Profile action.