VDB
CVE-2024-27443
CVE-2024-27443
PUBLISHED
KEV
CVSS 8.5 HIGH
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.
EPSS 23.63% · 97.6th percentile
Risk Scores
CVSS 4.0
8.5
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS Score
23.63%
97.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a, n/a |
| zimbra | collaboration | 10.0.0, 9.0.0, 9.0.0 |
Timeline
- Feb 28, 2024 CVE Published
- Aug 12, 2024 PoC Published
- Aug 13, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Nov 20, 2024 Coalition ESS Score
- Feb 18, 2025 Coalition ESS Score
- Mar 19, 2025 Coalition ESS Score
- May 16, 2025 PoC Published
- May 19, 2025 CISA KEV Added
- May 19, 2025 PoC Published
- May 19, 2025 PoC Published
- May 19, 2025 PoC Published
References
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes url
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes url
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-27443 advisory
- https://www.welivesecurity.com/en/eset-research/operation-roundpress url
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27443 url
- https://www.welivesecurity.com/en/eset-research/operation-roundpress/ third-party-advisory