CVE-2017-20188 – Zimbra zm-ajax XFormItem.js XFormItem.prototype.setError cross site scripting

https://notcve.org/view.php?id=CVE-2017-20188

A vulnerability has been found in Zimbra zm-ajax up to 8.8.1 and classified as problematic. Affected by this vulnerability is the function XFormItem.prototype.setError of the file WebRoot/js/ajax/dwt/xforms/XFormItem.js. The manipulation of the argument message leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. • https://github.com/Zimbra/zm-ajax/commit/8d039d6efe80780adc40c6f670c06d21de272105 https://github.com/Zimbra/zm-ajax/releases/tag/8.8.2 https://vuldb.com/?ctiid.249421 https://vuldb.com/?id.249421 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •