Vulnerability Intelligence Report
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
CVE-2022-24682
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
CISA KEV
Nuclei Template
SSVC: Active Exploitation
CVSS Base Score
6.1
MEDIUM
Exploitability:2.9
Impact Score:2.8
EPSS Probability:30.93%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-116 ↗CWE-116 Improper Encoding or Escaping of Output
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| n/a | n/a | n/a (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
Nuclei Template
SCANNER AVAILABLE
EPSS Score
30.931%
GitHub Advisory
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | MITRE Corporation · N/A · USA |
| Reserved | 2022-02-09T00:00:00 |
| Published | 2022-02-09T03:19:04 |
| Last Updated | 2026-08-07T03:55:20 |
Community Chatter & Buzz