Back to CVE Browser

CVE-2022-24682

🔥 Known Exploited (CISA KEV)MEDIUM

6.1

CVSS Severity Score

EPSS Score0.0000%

EPSS Percentile0.00th

Published2022-02-09

Last Modified2026-06-17

Data SourcesNVDCISA KEV

Vulnerability Description

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Affected Platforms (CPE)

📦

Synacor

Zimbra Collaboration Suite

>= 8.8.0 and < 8.8.15= 8.8.15

References & Advisories

🔗 https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/

🔗 https://wiki.zimbra.com/wiki/Security_Center

🔗 https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30

🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

🔗 https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/

🔗 https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/

🔗 https://wiki.zimbra.com/wiki/Security_Center

🔗 https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30

Related Vulnerabilities

CVE-2026-611427.7

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that ...

CVE-2026-611417.5

Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Affordable Care Act). Supported vers...

CVE-2026-611387.5

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Opera...

CVE-2026-611257.7

Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). Support...