Unscored severity · published Feb 24, 2012
CVE-2012-1213
Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x before 6.0.15 and 7.x before 7.1.3 allows remote…
–
CVSS
1.5%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in zimbra/h/calendar in Zimbra Web Client in Zimbra Collaboration Suite (ZCS) 6.x before 6.0.15 and 7.x before 7.1.3 allows remote attackers to inject arbitrary web script or HTML via the view parameter.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 74% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZI
Zimbra · Zimbra
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-1213
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-1213
Exploit
http://packetstormsecurity.org/files/109710/Zimbra-Cross-Site-Scripting.html
Exploit
http://st2tea.blogspot.com/2012/02/zimbra-cross-site-scripting.html
Exploit
http://www.securityfocus.com/bid/51974
bugzilla.zimbra.com
https://bugzilla.zimbra.com/show_bug.cgi?id=63849
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/73168
More from Zimbra
7.5
CVE-2023-38750
In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed
6.5
CVE-2024-9665
Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability
6.1
CVE-2020-11737
A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary…
6.1
CVE-2013-1938
Zimbra 2013 has XSS in aspell.php