← Vulnerability feed

Vulnerability record · CVE-2018-14013 · published 29 May 2019

CVE-2018-14013: Synacor zimbra collaboration suite cross-site scripting vulnerability

SSynacor · Zimbra Collaboration Suite

Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.

6.1 CVSS 3.0 Medium EPSS 7.4% · top 5.8% CWE-79 · Cross-site scripting
6.1CVSS 3.0 base score, v2 4.3
7.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
14References, 6 tagged exploit
17 Jun 2026Last modified by NVD

Description

Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/151472/Zimbra-Collaboration-Cross-Site-Scripting.html ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Feb/3 ExploitMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2019/01/30/1 ExploitMailing List
http://www.securityfocus.com/bid/106787 Third Party AdvisoryVDB Entry
https://bugzilla.zimbra.com/show_bug.cgi?id=109017 Issue TrackingThird Party Advisory
https://bugzilla.zimbra.com/show_bug.cgi?id=109018 Issue TrackingThird Party Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
http://packetstormsecurity.com/files/151472/Zimbra-Collaboration-Cross-Site-Scripting.html ExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Feb/3 ExploitMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2019/01/30/1 ExploitMailing List
http://www.securityfocus.com/bid/106787 Third Party AdvisoryVDB Entry
https://bugzilla.zimbra.com/show_bug.cgi?id=109017 Issue TrackingThird Party Advisory
https://bugzilla.zimbra.com/show_bug.cgi?id=109018 Issue TrackingThird Party Advisory
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory

Track CVE-2018-14013 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2024-45519Zimbra Collaboration postjournal service unauthenticated command executionThe postjournal service in Zimbra Collaboration Suite fails to properly neutralize input, allowing OS command injection. Because the service can be r…KEVEPSS 100%analysed9.8CVE-2022-41352Zimbra Collaboration amavis cpio path traversal arbitrary file uploadZimbra Collaboration Suite 8.8.15 and 9.0 allow an attacker to upload arbitrary files through amavis by abusing cpio archive extraction into the web-…KEVEPSS 95%analysed9.8CVE-2022-37042Zimbra Collaboration Suite mboximport auth bypass path traversal RCEZimbra Collaboration Suite 8.8.15 and 9.0 mboximport accepts a ZIP archive and extracts files without requiring an authtoken, allowing unauthenticate…KEVEPSS 92%analysed9.8CVE-2020-7796Zimbra Collaboration Suite WebEx zimlet SSRFZimbra Collaboration Suite before 8.8.15 Patch 7 is vulnerable to server-side request forgery when the WebEx zimlet is installed and its JSP is enabl…KEVEPSS 84%analysed9.8CVE-2019-9670Zimbra mailboxd Autodiscover XXE allows unauthenticated compromiseThe mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 parses XML in the Autodiscover servlet without restricting extern…KEVEPSS 100%analysed9.0CVE-2023-34192Zimbra ZCS autoSaveDraft XSS enables remote code executionZimbra Collaboration Suite 8.8.15 has a cross-site scripting flaw in the /h/autoSaveDraft function. A remote authenticated attacker can inject a craf…KEVEPSS 77%analysed8.9CVE-2026-73570Zimbra Collaboration SNMP notification OS command injectionZimbra Collaboration Suite before 10.1.20 contains an OS command injection flaw in SNMP notification processing when the optional zimbra-snmp package…KEVEPSS 12%analysed8.8CVE-2025-68645Zimbra Webmail Classic UI RestFilter local file inclusionZimbra Collaboration Suite 10.0 and 10.1 mishandle user-supplied parameters in the RestFilter servlet of the Webmail Classic UI, allowing local file …KEVEPSS 49%analysed

Source: NIST National Vulnerability Database (record CVE-2018-14013), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.