CVEvulnerability

CVE-2022-24682

6.1 MEDIUM Known exploited Published 2022-02-09 Modified 2026-08-07 Official page ↗

CISA Known Exploited Vulnerability

Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability — Synacor Zimbra Collaborate Suite (ZCS)

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.

Added to KEV
2022-02-25
Remediation due
2022-03-11
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2022-24682
Status
Analyzed
Published
2022-02-09
Last modified
2026-08-07
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
Weaknesses
CWE-116

Description

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Affected configurations

• synacor zimbra collaboration suite (>= 8.8.0 < 8.8.15) • synacor zimbra collaboration suite 8.8.15

Related

Weakness · CWE (1)

  • CWE-116 Improper Encoding or Escaping of Output weakness

References