CVE-2018-14013

MEDIUMNuclei

Synacor Zimbra Collaboration Suite (ZCS) Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2018-14013 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Aug 6, 2026 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Zimbra Collaboration Suite (ZCS)

Browse Synacor / Zimbra Collaboration Suite (ZCS)
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryMEDIUMSynacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site ScriptingCVSS 6.1

Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 is vulnerable to cross-site scripting via the AJAX and html web clients.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary script code in the context of the targeted user's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.

Remediation

Upgrade to a version of Synacor Zimbra Collaboration Suite Collaboration that is equal to or greater than 8.8.11 to mitigate the vulnerability.

WeaknessesCWE-79
Authorspikpikcu
Template tagscvecve2018xsszimbrasynacorvulnvkev
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
Shodan: http.title:"zimbra collaboration suite"
Shodan: http.title:"zimbra web client sign in"
FOFA: title="zimbra web client sign in"
FOFA: title="zimbra collaboration suite"
Google: intitle:"zimbra collaboration suite"
Google: intitle:"zimbra web client sign in"
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories https://bugzilla.zimbra.com/show_bug.cgi?id=109018 https://bugzilla.zimbra.com/show_bug.cgi?id=109017 https://nvd.nist.gov/vuln/detail/CVE-2018-14013 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

8