CVE-2024-27443
Description
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.
Summary dbcve.org
A stored Cross-Site Scripting (XSS) vulnerability exists in Zimbra Collaboration (ZCS) 9.0 and 10.0 within the CalendarInvite feature of the classic webmail interface. The calendar header field lacks proper input validation, allowing attackers to embed malicious JavaScript in calendar invitation emails. When recipients view these crafted messages, the XSS payload executes in their session context.
Mitigation
Apply the vendor security patch for CVE-2024-27443 immediately. Until patched, consider disabling the classic webmail interface or implementing Content Security Policy (CSP) headers as defense-in-depth measures.