CVE-2017-20191 – Zimbra zm-admin-ajax Form Textbox Field Error XFormItem.js XFormItem.prototype.setError cross site scripting

https://notcve.org/view.php?id=CVE-2017-20191

A vulnerability was found in Zimbra zm-admin-ajax up to 8.8.1. It has been classified as problematic. This affects the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js of the component Form Textbox Field Error Handler. The manipulation of the argument message leads to cross site scripting. It is possible to initiate the attack remotely. • https://github.com/Zimbra/zm-admin-ajax/commit/bb240ce0c71c01caabaa43eed30c78ba8d7d3591 https://github.com/Zimbra/zm-admin-ajax/releases/tag/8.8.2 https://vuldb.com/?ctiid.258621 https://vuldb.com/?id.258621 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •