Security readout for executives and security teams
Plain-English summary
This is a Zimbra webmail cross-site scripting flaw. A malicious email attachment can cause script or HTML to run when a user interacts with it. The vulnerability is medium by CVSS, but business urgency is higher because CISA lists CVE-2018-6882 in KEV as known exploited.
Executive priority
Treat this as a priority patching issue for any remaining legacy Zimbra estate. The technical severity is moderate, but KEV status means delayed remediation creates avoidable exposure in a high-value business system: email.
Technical view
ZmMailMsgView.getAttachmentLinkHtml in Zimbra Collaboration Suite before 8.7 Patch 1 and 8.8.x before 8.8.7 mishandles the Content-Location header in an email attachment, enabling stored or reflected web script injection in the user's browser context. The vector requires user interaction and has changed scope with low confidentiality and integrity impact.
Likely exposure
Exposure is most likely where Zimbra Collaboration Suite is still running before 8.7 Patch 1 or 8.8.x before 8.8.7. The provided affected CPE data is incomplete, so asset validation should rely on installed Zimbra versions and vendor advisories.
Exploitation context
CISA KEV inclusion indicates known exploitation. Sources do not provide current exploitation volume or campaign details. Abuse depends on delivering a crafted email attachment and getting a user to interact with the vulnerable webmail rendering path.
Researcher notes
The public description identifies the vulnerable function and attachment Content-Location handling, but the bundle does not include CPEs or detailed exploit telemetry. Validate by version and patch level, and avoid assuming exposure outside the named Zimbra Collaboration Suite version ranges.
Mitigation direction
- Inventory all Zimbra Collaboration Suite servers and record exact versions.
- Upgrade affected 8.8.x systems to 8.8.7 or later vendor-supported releases.
- Apply 8.7 Patch 1 if still on the 8.7 maintenance path.
- Review Zimbra security advisories for any later superseding guidance.
- Prioritize remediation for internet-facing or executive-used mail systems.
Validation and detection
- Confirm Zimbra version is not earlier than 8.7 Patch 1 or 8.8.7.
- Check patch history against Zimbra release and advisory records.
- Review mail gateway and web logs for suspicious attachment-related activity.
- Validate that users access Zimbra only through patched webmail components.
- Document any unsupported Zimbra instances as residual risk.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2018-6882 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.1 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N2.82.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.1MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.securify.nl/advisory/SFY20180101/cross-site-scripting-vulnerability-in-zimbra-collaboration-suite-due-to-the-way-it-handles-attachment-links.htmlCVE reference · x_refsource_MISC
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.7CVE reference · x_refsource_CONFIRM
- https://bugzilla.zimbra.com/show_bug.cgi?id=108786CVE reference · x_refsource_CONFIRM
- https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesCVE reference · x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6882CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.