« Volver al listado

CVE-2020-13653

Estado: ModificadaMedia (6.1)—

An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Synacor — Zimbra Collaboration Suite

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-13653",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-07-02T16:15:11.577",
  "references": [
    {
      "url": "https://wiki.zimbra.com/wiki/Security_Center",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P11",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P4",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Security_Center",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P11",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P4",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de tipo XSS en el componente Webmail de Zimbra Collaboration Suite versiones anteriores a 8.8.15 Parche 11. Permite a un atacante inyectar JavaScript ejecutable en el nombre de la cuenta del perfil de un usuario. El código inyectado puede ser reflejado y ejecutado cuando se cambia una firma de correo electrónico"
    }
  ],
  "lastModified": "2026-06-17T02:53:30.807",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8BF8662-919E-4A40-917F-FEA0EA73491C",
              "versionEndExcluding": "8.8.15"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E39A855-C0EB-4448-AE96-177757C40C66"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFE7BE6E-7A9A-40C7-B236-7A21103E9F41"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5924FFC-BA19-48B3-BF4D-0C2DB3FCD407"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FCB5528-70FD-4525-A78B-D5537609331A"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF2EE32D-04A5-46EA-92F0-3C8D74A4B82A"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB3C28CA-4C22-423E-B1C7-CBAFBB91F4DB"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9A1314A-20C8-42D7-9387-D914999EEAF6"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEF091C5-8DC6-4A41-9E84-F53BE703F71B"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACD65C28-9716-4073-8613-C4AF12684760"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C58AFFF-848F-490D-A95C-03A267C2DC98"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B62DC188-89A8-4AEA-90AE-563F0BBEFC54"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}