Actively exploited in the wild
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
Synacor - Zimbra Collaborate Suite (ZCS) · Listed in the CISA KEV since 2022-02-25. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2022-24682
MediumCVSS 6.1KEVExploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
The Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 allows an attacker to place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
Risk Assessment
An attacker could inject malicious scripts that execute in the victim's browser, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Apply the patch (patch 30 or later). Restrict access to the application and educate users about the risk of clicking suspicious links.
Original NVD description (English source)
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.