CVE-2018-6882

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting flaw (CWE-79) that allows remote attackers to inject arbitrary web script or HTML through the ZCS web interface. An attacker who successfully injects script can execute it in the browser context of a logged-in Zimbra user, enabling actions such as stealing session cookies or credentials, defacing webmail content, or chaining into further compromise; the specific injection vector is not detailed in the available data. Any organization running Zimbra Collaboration Suite, particularly deployments exposing the ZCS webmail interface to the internet, is affected. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-04-19 with known ransomware use, and EPSS estimates a 25.3% probability of exploitation within 30 days (98th percentile), although no public proof-of-concept is known.

What to do: Apply the latest Zimbra Collaboration Suite patches per Synacor's vendor instructions, as required by CISA's KEV listing, prioritizing internet-facing webmail servers given confirmed in-the-wild exploitation and known ransomware use. Because the affected version range is not specified in this data, check your current ZCS release against Synacor's advisory and upgrade to any patched release it designates. In the interim, restrict exposure of the ZCS web interface and monitor for unexpected injected script or HTML in webmail content.