CVE-2024-27443: Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.
Other sources
Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code.
— CISA
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27443?
CVE-2024-27443 is classified as a high-severity Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2024-27443?
To fix CVE-2024-27443, update your Zimbra Collaboration software to the latest version that includes the security patch.
Which versions of Zimbra Collaboration are affected by CVE-2024-27443?
CVE-2024-27443 affects Zimbra Collaboration versions 9.0.0 through 10.0.6.
What type of vulnerability is CVE-2024-27443?
CVE-2024-27443 is a Cross-Site Scripting (XSS) vulnerability in the CalendarInvite feature of Zimbra.
Can CVE-2024-27443 allow for unauthorized access?
Yes, an attacker can exploit CVE-2024-27443 to execute arbitrary scripts in the context of another user's session.