CVE-2017-20188

A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 8.8.2 is able to address this issue. The identifier of the patch is 8d039d6efe80780adc40c6f670c06d21de272105. It is recommended to upgrade the affected component. The identifier VDB-249421 was assigned to this vulnerability.

• CWE-79

• https://github.com/Zimbra/zm-ajax/commit/8d039d6efe80780adc40c6f670c06d21de272105Patch
• https://github.com/Zimbra/zm-ajax/releases/tag/8.8.2Release Notes
• https://vuldb.com/?ctiid.249421Permissions Required, Third Party Advisory
• https://vuldb.com/?id.249421Third Party Advisory
• https://github.com/Zimbra/zm-ajax/commit/8d039d6efe80780adc40c6f670c06d21de272105Patch
• https://github.com/Zimbra/zm-ajax/releases/tag/8.8.2Release Notes
• https://vuldb.com/?ctiid.249421Permissions Required, Third Party Advisory
• https://vuldb.com/?id.249421Third Party Advisory

Published

Jan 2, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-20182A vulnerability was found in Mobile Vikings Django AJAX Util…6.1
• CVE-2017-20183A vulnerability was found in External Media without Import P…6.1
• CVE-2017-20184Improper Limitation of a Pathname to a Restricted Directory …7.5
• CVE-2017-20185** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in…6.1
• CVE-2017-20186** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in…7.5
• CVE-2017-20187** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in…9.8
• CVE-2017-20189In Clojure before 1.9.0, classes can be used to construct a …9.8
• CVE-2017-2019Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-20190Some Microsoft technologies as used in Windows 8 through 11 …
• CVE-2017-20191A vulnerability was found in Zimbra zm-admin-ajax up to 8.8.…3.5
• CVE-2017-20192The Formidable Form Builder plugin for WordPress is vulnerab…6.1
• CVE-2017-20193The Product Vendors is vulnerable to Reflected Cross-Site Sc…6.1