CVE-2024-50599

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 63.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-07 · updated 2026-06-17
Weakness: CWE-79

Description

A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints. This arises from improper handling of user-supplied input, allowing an attacker to inject malicious code that is reflected back in the HTML response.

Affected products

Zimbra Collaboration: 8.8.15, 8.8.15-p1, 8.8.15-p10, 8.8.15-p11, 8.8.15-p12, 8.8.15-p13 (+41)

References

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Get alerted when CVE-2024-50599 or the next vulnerability affects your stack