UpHeron
All vulnerabilities

Servers and applications

CVE-2021-35208

An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Severity
Medium 5.4
Published
2 Jul 2021
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.8.15
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:zimbra:collaboration
  • Version 8.8.15-p22
  • Version 8.8.15-p21
  • Version 8.8.15-p20
  • Version 8.8.15-p19
All 24 release lines
  • From 8.8 before 8.8.15
  • Version 8.8.15
  • Version 8.8.15-p1
  • Version 8.8.15-p2
  • Version 8.8.15-p3
  • Version 8.8.15-p4
  • Version 8.8.15-p5
  • Version 8.8.15-p6
  • Version 8.8.15-p7
  • Version 8.8.15-p8
  • Version 8.8.15-p9
  • Version 8.8.15-p10
  • Version 8.8.15-p11
  • Version 8.8.15-p12
  • Version 8.8.15-p13
  • Version 8.8.15-p14
  • Version 8.8.15-p15
  • Version 8.8.15-p16
  • Version 8.8.15-p17
  • Version 8.8.15-p18
  • Version 8.8.15-p19
  • Version 8.8.15-p20
  • Version 8.8.15-p21
  • Version 8.8.15-p22

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2021-35208
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2021-35208