CVE-2020-11737

A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to…

published May 5, 2020

CVSS
—
EPSS
2%
Percentile
78.1
In the wild
Unconfirmed
What it is

A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring (including the quotes) followed immediately by a DOM event listener such as onmouseover. This is fixed in 9.0.0 Patch 2.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01781 · 78.1th percentile
Published
2020-05-05T14:08Z
EPSS history
Timeline
  • 05 MAY 14:08Z
    A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to…
    cvelistv5