UpHeron
All vulnerabilities

Servers and applications

CVE-2022-24682

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 25 Feb 2022.

Severity
Medium 6.1
Published
9 Feb 2022
Last changed
7 Aug 2026
Added to UpHeron
1 Nov 2026
Fixed in
8.8.15
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:synacor:zimbra_collaboration_suite
  • Version 8.8.15-p29
  • Version 8.8.15-p28
  • Version 8.8.15-p27
  • Version 8.8.15-p26
All 31 release lines
  • From 8.8.0 before 8.8.15
  • Version 8.8.15
  • Version 8.8.15-p1
  • Version 8.8.15-p2
  • Version 8.8.15-p3
  • Version 8.8.15-p4
  • Version 8.8.15-p5
  • Version 8.8.15-p6
  • Version 8.8.15-p7
  • Version 8.8.15-p8
  • Version 8.8.15-p9
  • Version 8.8.15-p10
  • Version 8.8.15-p11
  • Version 8.8.15-p12
  • Version 8.8.15-p13
  • Version 8.8.15-p14
  • Version 8.8.15-p15
  • Version 8.8.15-p16
  • Version 8.8.15-p17
  • Version 8.8.15-p18
  • Version 8.8.15-p19
  • Version 8.8.15-p20
  • Version 8.8.15-p21
  • Version 8.8.15-p22
  • Version 8.8.15-p23
  • Version 8.8.15-p24
  • Version 8.8.15-p25
  • Version 8.8.15-p26
  • Version 8.8.15-p27
  • Version 8.8.15-p28
  • Version 8.8.15-p29

Known exploited

CISA name
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
11 Mar 2022
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2022-24682
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2022-24682