PT-2022-4547 · Zimbra · Zimbra Collaboration Suite

Steven Adair + 1 · Published 2022-02-09 · Updated 2025-11-04 · CVE-2022-24682

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 8.8.x through 8.8.15 patch 29

Description An issue was discovered in the Calendar feature, allowing an attacker to place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document. The issue has been exploited in the wild starting in December 2021.

Recommendations For Zimbra Collaboration Suite versions 8.8.x through 8.8.15 patch 29, update to version 8.8.15 patch 30 (update 1) to resolve the issue. As a temporary workaround, consider restricting access to the Calendar feature until a patch is available. Avoid using the Calendar feature with untrusted input until the issue is resolved.

Exploit

Fix

Improper Encoding or Escaping of Output

XSS

Weakness Enumeration

CWE-116

CWE-79

Related Identifiers

BDU:2022-05422

CVE-2022-24682

Affected Products

Zimbra Collaboration Suite

References · 24

• 🔥 https://volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra · Exploit
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05422 · Security Note
• https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30 · Vendor Advisory
• https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24682 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24682 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://t.me/cvenotify/26495 · Telegram Post
• https://t.me/cvenotify/109098 · Telegram Post
• https://t.me/cibsecurity/37046 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24682 · Note
• https://t.me/cvenotify/112368 · Telegram Post
• https://t.me/cveNotify/141627 · Telegram Post