CVE-2018-18631

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2018-18631

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18631.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2018-18631

Published

2019-05-29T22:29:01.240Z

Modified

2026-07-08T05:51:09.279891775Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

mailboxd component in Synacor Zimbra Collaboration Suite 8.6, 8.7 before 8.7.11 Patch 7, and 8.8 before 8.8.10 Patch 2 has Persistent XSS.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.6.0"
                },
                {
                    "last_affected": "8.6.0"
                },
                {
                    "introduced": "8.6.0"
                },
                {
                    "last_affected": "8.6.0"
                },
                {
                    "introduced": "8.6.0"
                },
                {
                    "last_affected": "8.6.0"
                },
                {
                    "introduced": "8.6.0"
                },
                {
                    "last_affected": "8.6.0"
                },
                {
                    "introduced": "8.8.9-p6"
                },
                {
                    "last_affected": "8.8.9-p6"
                },
                {
                    "introduced": "8.8.9-p6"
                },
                {
                    "last_affected": "8.8.9-p6"
                },
                {
                    "introduced": "8.8.9-p6"
                },
                {
                    "last_affected": "8.8.9-p6"
                },
                {
                    "introduced": "8.8.9-p6"
                },
                {
                    "last_affected": "8.8.9-p6"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "synacor:zimbra_collaboration_suite",
            "cpes": [
                "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:*:*:*:*:*:*:*",
                "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p6:*:*:*:*:*:*"
            ]
        }
    ]
}

References

Affected packages

Git

github.com/zimbra/zm-build

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-build

Events

Introduced

Fixed

6c3c77b328a0d7d3bafecb79d202960217922ef0

Fixed

5000d7ff7c8650dbfff91678647fabc2bbf0e64b

Introduced

6c3c77b328a0d7d3bafecb79d202960217922ef0

Last affected

14a4dfad173dbbe623229e1a850b7610c76bc280

Database specific

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p6:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "8.7.0"
        },
        {
            "fixed": "8.7.11"
        },
        {
            "introduced": "8.8.0"
        },
        {
            "fixed": "8.8.9"
        },
        {
            "introduced": "8.7.11-NA"
        },
        {
            "last_affected": "8.7.11-NA"
        },
        {
            "introduced": "8.7.11-p1"
        },
        {
            "last_affected": "8.7.11-p1"
        },
        {
            "introduced": "8.7.11-p2"
        },
        {
            "last_affected": "8.7.11-p2"
        },
        {
            "introduced": "8.7.11-p3"
        },
        {
            "last_affected": "8.7.11-p3"
        },
        {
            "introduced": "8.7.11-p4"
        },
        {
            "last_affected": "8.7.11-p4"
        },
        {
            "introduced": "8.7.11-p5"
        },
        {
            "last_affected": "8.7.11-p5"
        },
        {
            "introduced": "8.7.11-p6"
        },
        {
            "last_affected": "8.7.11-p6"
        },
        {
            "introduced": "8.8.9-NA"
        },
        {
            "last_affected": "8.8.9-NA"
        },
        {
            "introduced": "8.8.9-p1"
        },
        {
            "last_affected": "8.8.9-p1"
        },
        {
            "introduced": "8.8.9-p3"
        },
        {
            "last_affected": "8.8.9-p3"
        },
        {
            "introduced": "8.8.10-NA"
        },
        {
            "last_affected": "8.8.10-NA"
        }
    ]
}

Affected versions

8.*

8.7.10

8.7.11

8.7.11-NA

8.7.11-p1

8.7.11-p2

8.7.11-p3

8.7.11-p4

8.7.11-p5

8.7.11-p6

8.7.6

8.7.7

8.7.9

8.8.0.beta1

8.8.10

8.8.10-NA

8.8.2

8.8.3

8.8.4

8.8.6

8.8.7

8.8.8

8.8.9

8.8.9-NA

8.8.9.p1

8.8.9.p3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18631.json"

github.com/zimbra/zm-mailbox

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-mailbox

Events

Introduced

Fixed

65929222951131db2cbb2378accbdd5f2fac0980

Fixed

d5dcfa4470bbb057d961a28fc9c35717eeaa7225

Introduced

65929222951131db2cbb2378accbdd5f2fac0980

Last affected

10ad918ac72828793da620ec43804208acd9d309

Database specific

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p6:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p2:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p4:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "8.7.0"
        },
        {
            "fixed": "8.7.11"
        },
        {
            "introduced": "8.8.0"
        },
        {
            "fixed": "8.8.9"
        },
        {
            "introduced": "8.7.11-NA"
        },
        {
            "last_affected": "8.7.11-NA"
        },
        {
            "introduced": "8.7.11-p1"
        },
        {
            "last_affected": "8.7.11-p1"
        },
        {
            "introduced": "8.7.11-p2"
        },
        {
            "last_affected": "8.7.11-p2"
        },
        {
            "introduced": "8.7.11-p3"
        },
        {
            "last_affected": "8.7.11-p3"
        },
        {
            "introduced": "8.7.11-p4"
        },
        {
            "last_affected": "8.7.11-p4"
        },
        {
            "introduced": "8.7.11-p5"
        },
        {
            "last_affected": "8.7.11-p5"
        },
        {
            "introduced": "8.7.11-p6"
        },
        {
            "last_affected": "8.7.11-p6"
        },
        {
            "introduced": "8.8.9-NA"
        },
        {
            "last_affected": "8.8.9-NA"
        },
        {
            "introduced": "8.8.9-p1"
        },
        {
            "last_affected": "8.8.9-p1"
        },
        {
            "introduced": "8.8.9-p2"
        },
        {
            "last_affected": "8.8.9-p2"
        },
        {
            "introduced": "8.8.9-p3"
        },
        {
            "last_affected": "8.8.9-p3"
        },
        {
            "introduced": "8.8.9-p4"
        },
        {
            "last_affected": "8.8.9-p4"
        },
        {
            "introduced": "8.8.10-NA"
        },
        {
            "last_affected": "8.8.10-NA"
        }
    ]
}

Affected versions

8.*

8.7.10

8.7.11-NA

8.7.11-p1

8.7.11-p2

8.7.11-p3

8.7.11-p4

8.7.11-p5

8.7.11-p6

8.7.6

8.7.7

8.7.9

8.8.10

8.8.10-NA

8.8.2

8.8.3

8.8.4

8.8.5

8.8.6

8.8.7

8.8.8

8.8.9

8.8.9-NA

8.8.9-p1

8.8.9-p2

8.8.9-p3

8.8.9-p4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18631.json"

github.com/zimbra/zm-zcs

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-zcs

Events

Introduced

Fixed

e177bad87d5312e7b2cd1915ae8c0cd2528cacdb

Fixed

d36a4c8999c6377b7ae36c22f47bbea75974e8cc

Introduced

e177bad87d5312e7b2cd1915ae8c0cd2528cacdb

Last affected

864fc8dba1bef16b89fa5cf0a677a724535675c8

Database specific

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "8.7.0"
        },
        {
            "fixed": "8.7.11"
        },
        {
            "introduced": "8.8.0"
        },
        {
            "fixed": "8.8.9"
        },
        {
            "introduced": "8.7.11-NA"
        },
        {
            "last_affected": "8.7.11-NA"
        },
        {
            "introduced": "8.7.11-p1"
        },
        {
            "last_affected": "8.7.11-p1"
        },
        {
            "introduced": "8.8.9-NA"
        },
        {
            "last_affected": "8.8.9-NA"
        },
        {
            "introduced": "8.8.10-NA"
        },
        {
            "last_affected": "8.8.10-NA"
        }
    ]
}

Affected versions

8.*

8.7.10

8.7.11

8.7.11-NA

8.7.11-p1

8.7.6

8.7.7

8.7.9

8.8.0.beta1

8.8.0beta2

8.8.10

8.8.10-NA

8.8.2

8.8.3

8.8.4

8.8.5

8.8.6

8.8.7

8.8.8

8.8.9

8.8.9-NA

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18631.json"

github.com/zimbra/zm-zcs-lib

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-zcs-lib

Events

Introduced

Fixed

a1cbf80618e47b3cf0894cbbcaec1da9bece583c

Fixed

6e5ea502a8b78a16e1c2d1d51331b62c31eb4c7e

Introduced

a1cbf80618e47b3cf0894cbbcaec1da9bece583c

Last affected

b157828cd338d5be2246bbcd6055b2992528e175

Database specific

{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "8.7.0"
        },
        {
            "fixed": "8.7.11"
        },
        {
            "introduced": "8.8.0"
        },
        {
            "fixed": "8.8.9"
        },
        {
            "introduced": "8.7.11-NA"
        },
        {
            "last_affected": "8.7.11-NA"
        },
        {
            "introduced": "8.7.11-p3"
        },
        {
            "last_affected": "8.7.11-p3"
        },
        {
            "introduced": "8.7.11-p4"
        },
        {
            "last_affected": "8.7.11-p4"
        },
        {
            "introduced": "8.8.9-NA"
        },
        {
            "last_affected": "8.8.9-NA"
        },
        {
            "introduced": "8.8.9-p3"
        },
        {
            "last_affected": "8.8.9-p3"
        },
        {
            "introduced": "8.8.10-NA"
        },
        {
            "last_affected": "8.8.10-NA"
        }
    ]
}

Affected versions

8.*

8.7.10

8.7.11

8.7.11-NA

8.7.11-p3

8.7.6

8.7.7

8.7.9

8.8.0.beta1

8.8.10

8.8.10-NA

8.8.2

8.8.3

8.8.4

8.8.5

8.8.6

8.8.7

8.8.8

8.8.9

8.8.9-NA

8.8.9-p3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18631.json"