CVE-2022-24682

MEDIUMCVSS 6.1Known Exploited

CISA Known Exploited Vulnerability

https://nvd.nist.gov/vuln/detail/CVE-2022-24682

Remediation deadline: March 11, 2022

Ransomware use: Known

Description

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.

Timeline

Published:February 9th, 2022 4:15 AM

Last modified:August 7th, 2026 5:16 AM

Added to KEV:February 25th, 2022

CVSS Scoring

CVSS v3: 6.1 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2: 4.3

Affected Software

From NVD CPE configuration data

Vendors

synacor

Products

zimbra_collaboration_suite

Weaknesses (CWE)

CWE-116

References & Reports

Advisories, patches, and third-party reports

https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/Vendor Advisory
https://wiki.zimbra.com/wiki/Security_CenterVendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/Exploit
https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/Vendor Advisory
https://wiki.zimbra.com/wiki/Security_CenterVendor Advisory
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24682US Government Resource

Source: NIST NVD · Data may lag official sources by up to one minute