Vulnerability Details CVE-2018-20160
ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.027
EPSS Ranking 85.1%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 7.5
References
- https://bugzilla.zimbra.com/show_bug.cgi?id=109093
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://bugzilla.zimbra.com/show_bug.cgi?id=109093
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
Products affected by CVE-2018-20160
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.0
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.1
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.10
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.2
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.3
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.4
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.5
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.6
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.7
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.8
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.9
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.0
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.11
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.2
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.3
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.4
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.5
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.6
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.7
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.8
-
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9