CVE-2021-35207

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Timeline

Published: Jul 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-352085.4An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An CVE-2021-352099.8An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9 CVE-2021-35214.7There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not CVE-2021-352106.1Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log CVE-2021-3521110.0Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerabi CVE-2021-352128.8An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injec CVE-2021-352138.8An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allo CVE-2021-352144.7The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When CVE-2021-352158.8Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to CVE-2021-352168.8Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration mo CVE-2021-352178.8Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration mod CVE-2021-352188.8Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has netw