Medium severity · published Aug 12, 2024
CVE-2024-27443
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
In wildKEV
6.1
CVSS
24.6%
EPSS
Yes
On KEV
Description
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)24.6% · higher than 98% of CVEs
Exploited in the wildYes
CISA KEVListed May 19, 2025
Federal remediation dueJun 9, 2025
Ransomware campaign useNot known
Affected products
Which versions
CO
Collaboration · Zimbra
10.0.0 before 10.0.7; 9.0.0; 9.0.0; 9.0.0; 9.0.0; 9.0.0; +32 more · source: NVD
ZC
Zimbra Collaboration Suite (ZCS) · Synacor
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-27443
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-27443
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
wiki.zimbra.com
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes
wiki.zimbra.com
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes
More from Collaboration
8.9
CVE-2026-73570
Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability
6.1
CVE-2025-66376
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability
9.8
CVE-2023-29382
An issue in Zimbra Collaboration ZCS v.8.8.15 and v.9.0 allows an attacker to execute arbitrary code via the sfdc_preauth.jsp component
9.8
CVE-2023-29381
An issue in Zimbra Collaboration (ZCS) v.8.8.15 and v.9.0 allows a remote attacker to escalate privileges and obtain sensitive information via the password and 2FA parameters
9.8
CVE-2022-32294
Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command)