{"id":"CVE-2018-6882","revision":"b8dee54a6e9047f6a0f95454f37de3f8","records":[{"revision":"b8dee54a6e9047f6a0f95454f37de3f8","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2018-6882","aliases":[],"title":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML v…","description":"Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.","state":0,"publishedAt":"2018-03-27T16:00:00+00:00","modifiedAt":"2026-10-01T19:33:16.504+00:00","affected":[{"ecosystem":"Vendor product","name":"n/a","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"n/a\",\n                    \"vendor\": \"n/a\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"n/a\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["http://seclists.org/fulldisclosure/2018/Mar/52","https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html","https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7","https://bugzilla.zimbra.com/show_bug.cgi?id=108786","http://www.securityfocus.com/archive/1/541891/100/0/threaded","https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2018-6882","license":"CVE Program Terms of Use","key":"cve-program:CVE-2018-6882","identifiers":["CVE-2018-6882"]},"retained":false,"historicalAffected":[]}],"coverage":[]}