CVE-2022-24682
KEV
🔴 Łataj teraz
Wstrzyknięcie kodu w Zimbra Collaboration Suite pozwala na wykonanie złośliwego JavaScriptu.
CVSS
6.1
EPSS
30.9%
Exploit
weaponized
Vendor
synacor
Opis źródłowy (NVD)
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 6.1 |
| CISA KEV (aktywnie wykorzystywane) | Tak |
| FIRST EPSS (prawdopodobieństwo exploita) | 30.9% |
| Opublikowano (NVD) | 2022-02-09 04:15:07 UTC |
| Ostatnia modyfikacja (NVD) | 2026-08-07 05:16:55 UTC |
Referencje
- https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/ (cve@mitre.org) [Vendor Advisory]
- https://wiki.zimbra.com/wiki/Security_Center (cve@mitre.org) [Vendor Advisory]
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30 (cve@mitre.org) [Release Notes, Vendor Advisory]
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories (cve@mitre.org) [Vendor Advisory]
- https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/ (cve@mitre.org) [Exploit, Third Party Advisory]
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24682 (134c704f-9b21-4f2e-91b3-4a467353bcc0) [US Government Resource]