CVE-2022-24682

Synacor Zimbra Collaborate Suite (ZCS): Cross-Site Scripting

As of , CVE-2022-24682 in Synacor Zimbra Collaborate Suite (ZCS) is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.

Exploited
Yes: CISA listed it on 25 February 2022
US federal deadline
11 March 202214 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Known
EPSS score
0.31Higher than 98% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
0.01 on 25 February 2022EPSS on the day CISA listed it.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.

CISA's description

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

The CVE record's description, from mitre

CVE published
9 February 2022
Assigned by
mitre
CVSS
6.1 Medium (CVSS 3.1, from CISA-ADP)
CWE-116
Improper Encoding or Escaping of Output
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
partial

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.
  4. CISA changed its entry. Renamed from Zimbra Webmail to Synacor Zimbra Webmail. Edited: description and name.
  5. CISA changed its entry. Renamed from Zimbra Webmail to Zimbra Collaborate Suite (ZCS). Edited: description and name.

Read further