UpHeron
All vulnerabilities

Servers and applications

CVE-2024-27443

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a…

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 19 May 2025.

Severity
Medium 6.1
Published
12 Aug 2024
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
10.0.7
Sources
NVD

Affected software

SoftwareAffected versions
Zimbra CollaborationServers and applications · cpe:a:zimbra:collaboration
  • From 10.0.0 before 10.0.7
  • Version 9.0.0-p38
  • Version 9.0.0-p37
  • Version 9.0.0-p36
All 38 release lines
  • Version 9.0.0
  • Version 9.0.0-p0
  • Version 9.0.0-p1
  • Version 9.0.0-p2
  • Version 9.0.0-p3
  • Version 9.0.0-p4
  • Version 9.0.0-p5
  • Version 9.0.0-p6
  • Version 9.0.0-p7
  • Version 9.0.0-p7.1
  • Version 9.0.0-p8
  • Version 9.0.0-p9
  • Version 9.0.0-p10
  • Version 9.0.0-p11
  • Version 9.0.0-p12
  • Version 9.0.0-p13
  • Version 9.0.0-p14
  • Version 9.0.0-p15
  • Version 9.0.0-p16
  • Version 9.0.0-p19
  • Version 9.0.0-p20
  • Version 9.0.0-p21
  • Version 9.0.0-p23
  • Version 9.0.0-p24
  • Version 9.0.0-p24.1
  • Version 9.0.0-p25
  • Version 9.0.0-p26
  • Version 9.0.0-p27
  • Version 9.0.0-p30
  • Version 9.0.0-p31
  • Version 9.0.0-p32
  • Version 9.0.0-p33
  • Version 9.0.0-p34
  • Version 9.0.0-p35
  • Version 9.0.0-p36
  • Version 9.0.0-p37
  • Version 9.0.0-p38
  • From 10.0.0 before 10.0.7

Known exploited

CISA name
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Due for US agencies
9 Jun 2025
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2024-27443
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2024-27443