Synacor Zimbra Collaboration Suite up to 8.8.0 Beta 1 Admin UI mail addrs Persistent cross site scripting
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 3.5 | $0-$5k | 0.00 |
Summary
A vulnerability identified as problematic has been detected in Synacor Zimbra Collaboration Suite up to 8.8.0 Beta 1. The impacted element is an unknown function of the component Admin UI. The manipulation of the argument mail addrs leads to cross site scripting (Persistent). This vulnerability is referenced as CVE-2018-10948. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.
Details
A vulnerability was found in Synacor Zimbra Collaboration Suite up to 8.8.0 Beta 1 (Groupware Software) and classified as problematic. This issue affects some unknown functionality of the component Admin UI. The manipulation of the argument mail addrs with an unknown input leads to a cross site scripting vulnerability (Persistent). Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:
Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.
The weakness was published 05/30/2019. The identification of this vulnerability is CVE-2018-10948 since 05/09/2018. The attack may be initiated remotely. A simple authentication is required for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.
Upgrading to version 8.8.0 Beta 2 eliminates this vulnerability.
Similar entry is available at VDB-135728. If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Product
Type
Vendor
Name
Version
License
Website
- Vendor: https://synacor.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 3.6VulDB Meta Temp Score: 3.5
VulDB Base Score: 2.4
VulDB Temp Score: 2.3
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 4.8
NVD Vector: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Name: PersistentClass: Cross site scripting / Persistent
CWE: CWE-79 / CWE-94 / CWE-74
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Zimbra Collaboration Suite 8.8.0 Beta 2
Timeline
05/09/2018 🔍05/30/2019 🔍
05/31/2019 🔍
09/25/2023 🔍
Sources
Vendor: synacor.comAdvisory: bugzilla.zimbra.com
Status: Not defined
CVE: CVE-2018-10948 (🔍)
GCVE (CVE): GCVE-0-2018-10948
GCVE (VulDB): GCVE-100-135725
See also: 🔍
Entry
Created: 05/31/2019 06:41Updated: 09/25/2023 09:58
Changes: 05/31/2019 06:41 (40), 06/17/2020 10:42 (18), 09/25/2023 09:58 (4)
Complete: 🔍
Cache ID: 216::103
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
No comments yet. Languages: en.
Please log in to comment.