CVE-2024-27443: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: yes — in CISA KEV since 2025-05-19
EPSS: 24.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-08-12 · updated 2026-06-17
Weakness: CWE-79

Description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.

Summary

CVE-2024-27443 is a cross-site scripting flaw in the CalendarInvite feature of the Zimbra webmail classic interface, caused by improper validation of the calendar header. An attacker can send an email with a crafted calendar header containing an XSS payload, which executes in the victim's session when the message is viewed, potentially running arbitrary JavaScript. Zimbra Collaboration 9.0 and 10.0 are affected, and the issue is fixed in 10.0.7. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with active exploitation and a public exploit exists, so teams should apply the vendor fix or mitigations promptly and follow BOD 22-01 guidance for cloud services.

CVE-2024-27443 هو ثغرة Cross-Site Scripting (XSS) في ميزة CalendarInvite ضمن واجهة Zimbra webmail classic، بسبب عدم التحقق السليم من مدخلات ترويسة التقويم. يمكن للمهاجم إرسال رسالة بريد إلكتروني تحتوي على ترويسة تقويم مُعدّة تحمل حمولة XSS تُنفَّذ في سياق جلسة الضحية عند عرض الرسالة، ما قد يؤدي إلى تنفيذ JavaScript عشوائي. تتأثر Zimbra Collaboration 9.0 و10.0، وتم إصلاح المشكلة في 10.0.7. الثغرة مدرجة في كتالوج CISA Known Exploited Vulnerabilities مع استغلال نشط ووجود exploit عام، لذا ينبغي تطبيق إصلاح المورّد أو التخفيفات فوراً واتباع إرشادات BOD 22-01 للخدمات السحابية.

Affected products

Zimbra Collaboration: from 10.0.0 before 10.0.7; 9.0.0, 9.0.0-p0, 9.0.0-p1, 9.0.0-p10, 9.0.0-p11, 9.0.0-p12 (+31) — fixed in 10.0.7

How to fix

Upgrade to a fixed version: Zimbra Collaboration 10.0.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-27443 or the next vulnerability affects your stack