CVE-2021-35208 | BDVDB-2026-156339 Detail

Description#

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23
https://blog.sonarsource.com/zimbra-webmail-compromise-via-email

Exploit#

No public exploit known

History#

Version 12021-07-02Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.