CVE-2017-20188

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2017-20188

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-20188.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2017-20188

Published

2024-01-02T15:15:08.377Z

Modified

2026-03-14T09:25:01.807794Z

Severity

4.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is 8d039d6efe80780adc40c6f670c06d21de272105. It is recommended to upgrade the affected component. The identifier VDB-249421 was assigned to this vulnerability.

References

Affected packages

Git / github.com/zimbra/zm-ajax

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-ajax

Events

Introduced

Fixed

e96e30f6888e2b0796b2467b189f93be35479216

Fixed

8d039d6efe80780adc40c6f670c06d21de272105

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "8.8.2"
        }
    ]
}

Affected versions

8.*

8.7.10

8.7.11

8.7.6

8.7.7

8.7.9

8.8.0.beta1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-20188.json"