CVE-2022-24682

CVE-2022-24682 is a medium-severity (CVSS 6.1) vulnerability in Synacor Zimbra Collaborate Suite (ZCS). CISA added it to the Known Exploited Vulnerabilities catalog on February 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by March 11, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Synacor has 19 vulnerabilities in the KEV catalog, 6 of them linked to ransomware.

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/
• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/
• https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/
• https://wiki.zimbra.com/wiki/Security_Center
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30