CVE-2021-35208

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-35208
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-35208.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-35208
Published
2021-07-02T19:15:08.417Z
Modified
2026-07-08T05:57:10.537292198Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p10:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p12:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p13:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p14:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p15:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p16:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p17:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p18:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p19:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p21:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p22:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p2:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p4:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p6:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p7:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p8:*:*:*:*:*:*",
                "cpe:2.3:a:zimbra:collaboration:8.8.15:p9:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "8.8.15-p10"
                },
                {
                    "last_affected": "8.8.15-p10"
                },
                {
                    "introduced": "8.8.15-p12"
                },
                {
                    "last_affected": "8.8.15-p12"
                },
                {
                    "introduced": "8.8.15-p13"
                },
                {
                    "last_affected": "8.8.15-p13"
                },
                {
                    "introduced": "8.8.15-p14"
                },
                {
                    "last_affected": "8.8.15-p14"
                },
                {
                    "introduced": "8.8.15-p15"
                },
                {
                    "last_affected": "8.8.15-p15"
                },
                {
                    "introduced": "8.8.15-p16"
                },
                {
                    "last_affected": "8.8.15-p16"
                },
                {
                    "introduced": "8.8.15-p17"
                },
                {
                    "last_affected": "8.8.15-p17"
                },
                {
                    "introduced": "8.8.15-p18"
                },
                {
                    "last_affected": "8.8.15-p18"
                },
                {
                    "introduced": "8.8.15-p19"
                },
                {
                    "last_affected": "8.8.15-p19"
                },
                {
                    "introduced": "8.8.15-p2"
                },
                {
                    "last_affected": "8.8.15-p2"
                },
                {
                    "introduced": "8.8.15-p21"
                },
                {
                    "last_affected": "8.8.15-p21"
                },
                {
                    "introduced": "8.8.15-p22"
                },
                {
                    "last_affected": "8.8.15-p22"
                },
                {
                    "introduced": "8.8.15-p4"
                },
                {
                    "last_affected": "8.8.15-p4"
                },
                {
                    "introduced": "8.8.15-p6"
                },
                {
                    "last_affected": "8.8.15-p6"
                },
                {
                    "introduced": "8.8.15-p7"
                },
                {
                    "last_affected": "8.8.15-p7"
                },
                {
                    "introduced": "8.8.15-p8"
                },
                {
                    "last_affected": "8.8.15-p8"
                },
                {
                    "introduced": "8.8.15-p9"
                },
                {
                    "last_affected": "8.8.15-p9"
                }
            ],
            "source": "CPE_STRING",
            "vendor_product": "zimbra:collaboration"
        }
    ]
}
References

Affected packages

Git / github.com/zimbra/zm-build

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-build
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ac6081fa002b1511e926aba37740d2b6c20f3f43
Introduced
ac6081fa002b1511e926aba37740d2b6c20f3f43
Last affected
0e40da921adb967639011de45841cef4c4601413
Database specific 
{
    "extracted_events": [
        {
            "introduced": "8.8"
        },
        {
            "fixed": "8.8.15"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p1"
        },
        {
            "last_affected": "8.8.15-p1"
        },
        {
            "introduced": "8.8.15-p11"
        },
        {
            "last_affected": "8.8.15-p11"
        },
        {
            "introduced": "8.8.15-p20"
        },
        {
            "last_affected": "8.8.15-p20"
        },
        {
            "introduced": "8.8.15-p3"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "8.8.15-p5"
        },
        {
            "last_affected": "8.8.15-p5"
        }
    ],
    "cpe": [
        "cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p20:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p3:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p5:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

8.*
8.8.15
8.8.15-NA
8.8.15-p1
8.8.15-p20
8.8.15-p3
8.8.15-p5
8.8.15.p3
8.8.15.p5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-35208.json"