VYPR
← All advisories
Medium severity6.1NVD Advisory· Published May 5, 2020· Updated Jun 17, 2026

CVE-2020-11737

CVE-2020-11737

Description

A cross-site scripting (XSS) vulnerability in Web Client in Zimbra 9.0 allows a remote attacker to craft links in an E-Mail message or calendar invite to execute arbitrary JavaScript. The attack requires an A element containing an href attribute with a "www" substring (including the quotes) followed immediately by a DOM event listener such as onmouseover. This is fixed in 9.0.0 Patch 2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Zimbra/Zimbra2 versions
    cpe:2.3:a:zimbra:zimbra:9.0.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:zimbra:zimbra:9.0.0:*:*:*:*:*:*:*
    • (no CPE)range: 9.0.0 Patch 2
  • Zimbra/Web Clientdescription
  • Zimbra/Zimbra Web Clientllm-fuzzy
    Range: 9.0.0 Patch 2

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.