PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-3411 Synacor CVE debrief

CVE-2016-3411 is a medium-severity cross-site scripting issue in Zimbra Collaboration before 8.7.0. The NVD record maps it to CWE-79 and indicates vulnerable versions through 8.6.0. Because the attack requires network access and user interaction, the main risk is malicious web content or injected HTML/script reaching Zimbra users through the web interface.

Vendor
Synacor
Product
CVE-2016-3411
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-18
Original CVE updated
2026-05-13
Advisory published
2017-01-18
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for Zimbra Collaboration deployments, especially organizations running versions 8.6.0 or earlier and users who access Zimbra through a browser.

Technical summary

The public record describes a cross-site scripting vulnerability that lets a remote attacker inject arbitrary web script or HTML via unspecified vectors. NVD classifies the issue as CWE-79 and scores it CVSS 3.0 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), indicating no privileges are needed but a user must interact with the content. The affected CPE range covers Zimbra Collaboration Suite up to 8.6.0, and Zimbra 8.7.0 release notes are the cited fixed-version reference.

Defensive priority

Medium. Patch promptly if Zimbra is internet-facing or broadly used, but the user-interaction requirement makes this less urgent than a fully unauthenticated wormable flaw.

Recommended defensive actions

  • Upgrade Zimbra Collaboration to 8.7.0 or later, following vendor guidance.
  • Confirm every deployment is on a non-vulnerable version; treat 8.6.0 and earlier as affected.
  • Review Zimbra Security Advisories and release notes before and after upgrading to verify the fix is present.
  • Monitor web-access and application logs for suspicious HTML/script injection attempts or abnormal client-side behavior.
  • If immediate upgrade is not possible, reduce exposure of the Zimbra web interface to the smallest practical audience until remediation is complete.

Evidence notes

The summary is based on the CVE description, NVD's CVSS/vector and CPE data, and the linked Zimbra 8.7.0 release notes and Zimbra Security Advisories. The record also includes public references to SecurityFocus BID 95901 and an Exploit-DB entry; these are noted as references only and not used to provide exploit instructions. The CVE was published on 2017-01-18 and the supplied NVD record was modified on 2026-05-13.

Official resources

CVE-2016-3411 was published on 2017-01-18 and later modified on 2026-05-13 in the supplied NVD record. No KEV listing is present in the supplied data.