Cross Site Scripting Vulnerability in Zimbra zm-admin-ajax Prior to 8.8.1

CVE-2017-20191

What is CVE-2017-20191?

A vulnerability exists in Zimbra's zm-admin-ajax component that affects the Form Textbox Field Error Handler. Specifically, the function XFormItem.prototype.setError in the WebRoot/js/ajax/dwt/xforms/XFormItem.js file is susceptible to cross-site scripting attacks. This vulnerability allows an attacker to manipulate the error message argument, leading to potential remote exploitation. The issue is patched in version 8.8.2, and users are strongly advised to upgrade to ensure their systems are secure.

References