PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-3410 Synacor CVE debrief

CVE-2016-3410 describes multiple cross-site scripting (XSS) issues in Zimbra Collaboration before 8.7.0. The vulnerability is network-reachable and requires user interaction, which makes it especially relevant for webmail and collaboration deployments where attackers can lure users into viewing crafted content. The NVD record classifies the weakness as CWE-79 and rates it medium severity.

Vendor
Synacor
Product
CVE-2016-3410
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Administrators and security teams running Zimbra Collaboration, especially internet-facing deployments, should treat this as a web application content-injection issue that can affect users who browse or interact with maliciously crafted mail, pages, or interface elements.

Technical summary

The source corpus indicates multiple XSS bugs in Zimbra Collaboration, described in the CVE text as affecting versions before 8.7.0. NVD maps the issue to CWE-79 and lists a CVSS v3.0 vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating remote exploitation with user interaction and potential impact to confidentiality and integrity through script or HTML injection. The supplied NVD CPE range marks Zimbra Collaboration Suite versions through 8.6.0 as vulnerable, which is consistent with the vendor-facing description that the issue was addressed in the 8.7.0 release line.

Defensive priority

Medium. This is not listed as a KEV item in the supplied data, but it is still worth prompt remediation on any exposed Zimbra Collaboration deployment because XSS can enable session theft, phishing inside trusted UI flows, and unauthorized actions performed in a victim's browser.

Recommended defensive actions

  • Verify whether any Zimbra Collaboration systems are running a release earlier than 8.7.0.
  • Review the Zimbra 8.7.0 release notes and related vendor advisories to confirm the fix path and any dependent update steps.
  • Apply the vendor-recommended upgrade or patch as soon as practical on affected systems.
  • After updating, test common webmail and admin workflows to confirm normal rendering and no regressions in HTML or script handling.
  • Harden browser-facing defenses where possible, including secure cookie settings and content handling controls, to reduce the impact of any residual XSS exposure.
  • Monitor authentication, mailbox, and admin activity for signs of suspicious browser-driven actions or unusual session behavior.

Evidence notes

Primary evidence comes from the official NVD record and linked vendor resources. The CVE description states multiple XSS vulnerabilities in Zimbra Collaboration before 8.7.0. NVD lists CWE-79 and the CVSS v3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The supplied NVD CPE data identifies Synacor Zimbra Collaboration Suite as vulnerable through 8.6.0. Official reference links provided in the source set include the Zimbra 8.7.0 release notes and the Zimbra security advisories page.

Official resources

Publicly disclosed in the official CVE/NVD record on 2017-01-18. The supplied data shows an NVD modification date of 2026-05-13, but that is a record update date, not the original vulnerability disclosure date. No KEV entry is present inthe