CVE-2022-24682Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

6.1 MEDIUMEPSS 30.93%⚡ Known Exploited (CISA KEV)NVD: Analyzed

Last updated: 2026-08-07 05:16 UTC

OverviewCVSS details

6.1MEDIUMCVSS 3.1

Score source: NVD
NVD status: Analyzed
Published: Feb 9, 2022
Assigner: mitre

Affected

zimbra collaboration suite (synacor)

Versions: 8.8.0 before 8.8.15 · 8.8.15
Fixed in: 8.8.15

All affected versions →

Exploitation

Public exploit: Yes · 1 reference
CISA KEV: Listed · Feb 25, 2022
KEV due date: Mar 11, 2022
Ransomware use: Known
SSVC: Exploitation active · Automatable no · Impact partial

EPSS · FIRST, scored Nov 7

30.93%chance of exploitation in 30 days

Higher than 98.26% of CVEs

CVSS 3.1 · NVD

6.1Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Changed
Confidentiality impact: Low
Integrity impact: Low
Availability impact: None

CVSS 2.0 · NVD

4.3Medium

AV:N/AC:M/Au:N/C:N/I:P/A:N

Attack vector: Network
Attack complexity: Medium
Authentication: None
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

NVD status: Analyzed

Overview Affected Products References

NVD CVE.org

Overview

Severity

Score	Severity	Version	Vector String
6.1	MEDIUM	3.1NVD	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.3	MEDIUM	2.0NVD	AV:N/AC:M/Au:N/C:N/I:P/A:N

CISA required action

⚡ Known exploited · remediation due Mar 11, 2022

Apply updates per vendor instructions.

Details

CVE ID: CVE-2022-24682
Status: Analyzed
Assigner (CNA): mitre
Published: Feb 9, 2022
Last modified: 2026-08-07 05:16 UTC
Weaknesses: CWE-116
CWE-79

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 11:52 UTC.