CVE-2021-35208

PoC —

CVSS 3.1

5.4 medium

EPSS

1%p68

Published

Jul 2, 2021 (Jul 2, 2021)

Modified

Jun 17, 2026

Description

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Vendors: zimbra
Products: collaboration
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.3%)

In the news2 stories

Flaws in Zimbra could allow to takeover webmail server of an organization

Security AffairsJul 27, 20:35 UTC · Jul 27, 2021Vulnerability CVE-2021-35208 CVE-2021-35209

New Bug Could Let Attackers Hijack Zimbra Server by Sending Malicious Email

The Hacker NewsJul 27, 15:46 UTC · Jul 27, 2021Vulnerability CVE-2021-35208 CVE-2021-35209