Skip to content
Fencer Vulns
medium 6.1

CVE-2022-24682 kev+ ransomware in the critical feed json

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the…

published 2022-02-09 4 y ago modified 2026-08-07 3 mo ago also EUVD-2022-29554

cvss
6.1
version 3.1, CNA
cisa kev
Exploited
added 2022-02-25, used in ransomware
epss
30.9%
EPSS 30.9% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known, plus a Nuclei check

Summary

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • synacor zimbra_collaboration_suite 8.8.15

Timeline

  1. Found exploited as a 0-day (Project Zero)
  2. CISA SSVC: exploitation active
  3. 0-day patched (Project Zero)
  4. Published
  5. Added to CISA KEV
  6. CISA patch deadline

Known exploited

Added
4 y ago
Patch by
2022-03-11 (4 y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor, product
Synacor, Zimbra Collaborate Suite (ZCS)
CISA name
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Found
2021-12-16
Patched
2022-02-05
Details
project zero tracker

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1204.001 Malicious Link exploitation
  • T1059.007 JavaScript primary impact
  • T1185 Browser Session Hijacking secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
partial
Assessed
4 y ago

Exploit prediction

30.93% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template Zimbra Collaboration Suite < 8.8.15 - Improper Encoding nuclei detection template
  • volexity.com https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-116 Improper Encoding or Escaping of Output

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.