Synacor · Zimbra Collaborate Suite (ZCS)
CVE-2022-24682
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
What it is
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting (XSS) vulnerability in the Calendar feature that allows an attacker to execute arbitrary code.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 11, 2022
- Added to the CISA list
- February 25, 2022
- Published
- February 9, 2022
- Severity
- Medium 6.1 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 31% in the top 1.8% of all known vulnerabilities
- Weakness
- CWE-79 CWE-116
- More details
- NVD · CVE.org · CISA
All references (5)
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://wiki.zimbra.com/wiki/Security_Center
- https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerabili…
- https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30
More exploited flaws from Synacor
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 21, 2026 | OS Command Injection | Zimbra Collaboration Suite (ZCS) | High 8.9 | 72% |
| Apr 20, 2026 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 1.7% |
| Mar 18, 2026 | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | High 7.2 | 20% |
| Feb 17, 2026 | (ZCS) Server-Side Request Forgery | Zimbra Collaboration Suite | Critical 9.8 | 94% |
| Jan 22, 2026 | Zimbra Collaboration Suite (ZCS) PHP Remote File Inclusion | Zimbra Collaboration Suite (ZCS) | High 8.8 | 49% |
| Oct 7, 2025 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Medium 5.4 | 4.1% |
| Jul 7, 2025 | Server-Side Request Forgery (SSRF) | Zimbra Collaboration Suite (ZCS) | High 7.5 | 81% |
| May 19, 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 25% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.