{"id":"CVE-2024-27443","published":"2024-08-12T15:15:20Z","modified":"2026-06-17T07:19:54Z","title":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","tier":"core","eol":null,"description":{"text":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a cross-site scripting vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface in Synacor's Zimbra Collaboration Suite (ZCS), caused by improper input validation of the calendar header. An attacker can send an email containing a crafted calendar header with an embedded script payload, which executes in the victim's session with arbitrary JavaScript when the victim views the message in the classic interface, requiring user interaction but no authentication.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:49Z"},"cvss":{"score":6.1,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.24606,"percentile":0.97881,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-05-19","dueDate":"2025-06-09","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes ; https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes ; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes ; https://nvd.nist.gov/vuln/detail/CVE-2024-27443","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-05-15","exploitedFirstSeen":"2025-05-15","ransomware":false,"evidence":[{"url":"https://www.welivesecurity.com/en/eset-research/operation-roundpress/","date":"2025-05-15"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-05-19"},{"url":"https://cyble.com/blog/latest-security-vulnerabilities-ivanti/","date":"2025-05-20"},{"url":"https://www.picussecurity.com/resource/blog/apt28-cyber-threat-profile-and-detailed-ttps","date":"2025-12-10"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes","tags":["Release Notes"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27443","tags":["US Government Resource"]},{"url":"https://www.welivesecurity.com/en/eset-research/operation-roundpress/","tags":["Press/Media Coverage"]}],"techniques":[{"id":"T1566.002","name":"Spearphishing Link","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"exploitation_technique","evidence":[],"comment":"Attackers can send a malicious email with a specially crafted calendar header in order to execute arbitrary JavaScript code in the browser. This can lead to email collection, which can then be exfiltrated.","confidence":"high"},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"primary_impact","evidence":[],"comment":"Attackers can send a malicious email with a specially crafted calendar header in order to execute arbitrary JavaScript code in the browser","confidence":"high"},{"id":"T1114","name":"Email Collection","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"primary_impact","evidence":[],"comment":"Attackers can send a malicious email with a specially crafted calendar header in order to execute arbitrary JavaScript code in the browser","confidence":"high"},{"id":"T1041","name":"Exfiltration Over C2 Channel","tactics":["exfiltration"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Cross-site Scripting (XSS)","mappingType":"secondary_impact","evidence":[],"comment":"Attackers can send a malicious email with a specially crafted calendar header in order to execute arbitrary JavaScript code in the browser","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-24646","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-24646","exploited":true,"exploitedSince":"2025-05-19","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2024-27443","name":"Zimbra Collaboration - Cross-Site Scripting (XSS)","severity":"medium","path":"http/cves/2024/CVE-2024-27443.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27443.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1566.002"],"provenance":"source"},{"stage":"primary","techniques":["T1059.004","T1114"],"provenance":"source"},{"stage":"secondary","techniques":["T1041"],"provenance":"source"}],"timeline":[{"date":"2024-08-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27443","provenance":"source"},{"date":"2025-05-15","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.welivesecurity.com/en/eset-research/operation-roundpress/","provenance":"source"},{"date":"2025-05-19","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-05-19","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-24646","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":280},"priority":{"score":66.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 534 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.58,"detail":"percentile 0.9788"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.27,"detail":"base score 6.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-synacor-zimbra-collaboration-suite-zcs-cwe-79"}}