CVE-2021-35207

6.1 mediumEPSS 3.3%

Medium (6.1) in zimbra collaboration. EPSS 3.3% chance of exploitation in the next 30 days.

An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url.

Severity

CVSS 3.1

6.1 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS: 3.3% chance of exploitation in the next 30 days; higher than 88% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-07-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zimbra:collaboration

References

https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://wiki.zimbra.com/wiki/Security_Center

Check your stack JSON