QwikSec

Security Database

CVE

CWE

Training

CVE-2022-24682

Published: Feb 9, 2022

Modified: Oct 21, 2025

PUBLISHED

Description

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

x_refsource_MISC

https://wiki.zimbra.com/wiki/Security_Center

x_refsource_MISC

https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/

x_refsource_MISC

https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/

x_refsource_MISC

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.