CVE-2017-20191

Name of the Vulnerable Software and Affected Versions Zimbra versions up to 8.8.1

Description A problematic issue was found in the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js of the component Form Textbox Field Error Handler. The manipulation of the argument message leads to cross-site scripting. It is possible to initiate the attack remotely.

Recommendations For Zimbra versions up to 8.8.1, upgrade to version 8.8.2 to address this issue. As a temporary workaround, consider restricting access to the XFormItem.prototype.setError function until the upgrade is applied.