CVE-2021-35208

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.sonarsource.com/zimbra-webmail-compromise-via-emailExploit, Mitigation, Third Party Advisory
https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23Release Notes, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16Release Notes, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
https://blog.sonarsource.com/zimbra-webmail-compromise-via-emailExploit, Mitigation, Third Party Advisory
https://wiki.zimbra.com/wiki/Security_CenterRelease Notes, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23Release Notes, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16Release Notes, Vendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory

Timeline

Published: Jul 2, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-352099.8An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.x before 9 CVE-2021-35214.7There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not CVE-2021-352106.1Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log CVE-2021-3521110.0Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerabi CVE-2021-352128.8An SQL injection Privilege Escalation Vulnerability was discovered in the Orion Platform reported by the ZDI Team. A blind Boolean SQL injec CVE-2021-352138.8An Improper Access Control Privilege Escalation Vulnerability was discovered in the User Setting of Orion Platform version 2020.2.5. It allo CVE-2021-352144.7The vulnerability in SolarWinds Pingdom can be described as a failure to invalidate user session upon password or email address change. When CVE-2021-352158.8Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. Authentication is required to CVE-2021-352168.8Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration mo CVE-2021-352178.8Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration mod CVE-2021-352188.8Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. An unauthorized attacker who has netw CVE-2021-352194.9ExportToPdfCmd Arbitrary File Read Information Disclosure Vulnerability using ImportAlert function within the Alerts Settings page.