MEDIUM

CVE-2022-24682

Synacor Zimbra Collaboration Suite 2022-02-09 CVSS v3.1

CVSS

6.1

KEV

Description

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Summary dbcve.org

A stored cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite 8.8.x Calendar feature allows attackers to inject HTML containing executable JavaScript into element attributes. The content is not properly escaped, causing arbitrary markup injection into the document when users access the calendar.

Mitigation

Upgrade to Zimbra 8.8.15 patch 30 (update 1) or later to remediate this vulnerability. Until patched, restrict calendar sharing and monitor for malicious content.

Proof of Concept

Weakness (CWE)

CWE-116

EPSS Score

30.93%

Probability of exploitation in next 30 days

98.2th percentile

References

https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/ Vendor Advisory https://wiki.zimbra.com/wiki/Security_Center Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30 Release Notes, Vendor Advisory https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/ Exploit, Third Party Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24682 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE