CVE-2022-24682

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

The vulnerability is an improper input neutralization issue (CWE-116) in the Calendar feature of Zimbra Collaboration Suite 8.8.x releases prior to 8.8.15 patch 30 (update 1). An attacker can supply HTML containing executable JavaScript inside element attributes; the markup is not escaped before being rendered, resulting in arbitrary script injection into the document served to users.

An unauthenticated remote attacker can exploit the flaw by delivering a malicious calendar item or invitation that triggers the injection when a victim views the calendar. Successful exploitation allows the attacker to execute JavaScript in the context of the victim's Zimbra session, enabling theft of session data or other actions within the changed security context reflected in the CVSS scoring.

Zimbra published a hotfix on 5 February 2022 and corresponding patch 30 (update 1) that addresses the zero-day. Administrators are directed to apply the update immediately; the vendor's security center and release notes list the fixed builds and advise monitoring the Zimbra Security Advisories page for further guidance.

The vulnerability was exploited in the wild beginning in December 2021 as part of Operation Emailthief, with Volexity reporting active campaigns targeting Zimbra deployments prior to public disclosure. The EPSS score reached a peak of 0.8863 with no material post-disclosure rise indicated.