CVE-2021-35208

Published: Jul 2, 2021Modified: Nov 21, 2024

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Affected (24)

Products: Zimbra: Collaboration

Zimbra

1 product

Collaboration

Configuration A

24 vulnerable

Vulnerable Software	Affected Versions
Zimbra Collaboration	From 8.8 to 8.8.15
Zimbra Collaboration	Version 8.8.15
Zimbra Collaboration	Version 8.8.15 p10
Zimbra Collaboration	Version 8.8.15 p11
Zimbra Collaboration	Version 8.8.15 p12
Zimbra Collaboration	Version 8.8.15 p13
Zimbra Collaboration	Version 8.8.15 p14
Zimbra Collaboration	Version 8.8.15 p15
Zimbra Collaboration	Version 8.8.15 p16
Zimbra Collaboration	Version 8.8.15 p17
Zimbra Collaboration	Version 8.8.15 p18
Zimbra Collaboration	Version 8.8.15 p19
Zimbra Collaboration	Version 8.8.15 p1
Zimbra Collaboration	Version 8.8.15 p20
Zimbra Collaboration	Version 8.8.15 p21
Zimbra Collaboration	Version 8.8.15 p22
Zimbra Collaboration	Version 8.8.15 p2
Zimbra Collaboration	Version 8.8.15 p3
Zimbra Collaboration	Version 8.8.15 p4
Zimbra Collaboration	Version 8.8.15 p5
Zimbra Collaboration	Version 8.8.15 p6
Zimbra Collaboration	Version 8.8.15 p7
Zimbra Collaboration	Version 8.8.15 p8
Zimbra Collaboration	Version 8.8.15 p9