CVE-2012-1213: Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration...

Security readout for executives and security teams

CVE-2012-1213 is a cross-site scripting issue in Zimbra Web Client calendar handling. A remote attacker could cause script or HTML to run in a user's browser through the calendar view parameter. The main business risk is user-session compromise, phishing within webmail, or unauthorized actions under a victim's account context. Exposure is likely for organizations still running Zimbra Collaboration Suite 6.x before 6.0.15 or 7.x before 7.1.3 with Zimbra Web Client accessible to users or the internet. Later versions are not described as affected in the provided bundle. Treat this as a moderate-priority legacy Zimbra risk. It is old and not KEV-listed, but exposed webmail is high-value. Organizations still running affected versions should upgrade promptly and verify whether any vulnerable calendar endpoint remains reachable. Mitigation focus: Upgrade Zimbra Collaboration Suite 6.x to 6.0.15 or later.; Upgrade Zimbra Collaboration Suite 7.x to 7.1.3 or later.; Check Zimbra vendor guidance for any additional hardening or backported fixes..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.