CVE-2021-35208

5.4 mediumEPSS 1.3%

Medium (5.4) in zimbra collaboration. EPSS 1.3% chance of exploitation in the next 30 days.

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2021-07-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

zimbra:collaboration

References

https://blog.sonarsource.com/zimbra-webmail-compromise-via-email
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P23
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P16
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Check your stack JSON