CVE-2024-27443: XSS
First published: Mon Aug 12 2024(Updated: )
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zimbra Collaboration Suite | >=10.0.0<10.0.7 | |
| Zimbra Collaboration Suite | =9.0.0 | |
| Zimbra Collaboration Suite | =9.0.0-p0 | |
| Zimbra Collaboration Suite | =9.0.0-p1 | |
| Zimbra Collaboration Suite | =9.0.0-p10 | |
| Zimbra Collaboration Suite | =9.0.0-p11 | |
| Zimbra Collaboration Suite | =9.0.0-p12 | |
| Zimbra Collaboration Suite | =9.0.0-p13 | |
| Zimbra Collaboration Suite | =9.0.0-p14 | |
| Zimbra Collaboration Suite | =9.0.0-p15 | |
| Zimbra Collaboration Suite | =9.0.0-p16 | |
| Zimbra Collaboration Suite | =9.0.0-p19 | |
| Zimbra Collaboration Suite | =9.0.0-p2 | |
| Zimbra Collaboration Suite | =9.0.0-p20 | |
| Zimbra Collaboration Suite | =9.0.0-p21 | |
| Zimbra Collaboration Suite | =9.0.0-p23 | |
| Zimbra Collaboration Suite | =9.0.0-p24 | |
| Zimbra Collaboration Suite | =9.0.0-p24.1 | |
| Zimbra Collaboration Suite | =9.0.0-p25 | |
| Zimbra Collaboration Suite | =9.0.0-p26 | |
| Zimbra Collaboration Suite | =9.0.0-p27 | |
| Zimbra Collaboration Suite | =9.0.0-p3 | |
| Zimbra Collaboration Suite | =9.0.0-p30 | |
| Zimbra Collaboration Suite | =9.0.0-p31 | |
| Zimbra Collaboration Suite | =9.0.0-p32 | |
| Zimbra Collaboration Suite | =9.0.0-p33 | |
| Zimbra Collaboration Suite | =9.0.0-p34 | |
| Zimbra Collaboration Suite | =9.0.0-p35 | |
| Zimbra Collaboration Suite | =9.0.0-p36 | |
| Zimbra Collaboration Suite | =9.0.0-p37 | |
| Zimbra Collaboration Suite | =9.0.0-p38 | |
| Zimbra Collaboration Suite | =9.0.0-p4 | |
| Zimbra Collaboration Suite | =9.0.0-p5 | |
| Zimbra Collaboration Suite | =9.0.0-p6 | |
| Zimbra Collaboration Suite | =9.0.0-p7 | |
| Zimbra Collaboration Suite | =9.0.0-p7.1 | |
| Zimbra Collaboration Suite | =9.0.0-p8 | |
| Zimbra Collaboration Suite | =9.0.0-p9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-27443?
CVE-2024-27443 is classified as a high-severity Cross-Site Scripting (XSS) vulnerability.
How do I fix CVE-2024-27443?
To fix CVE-2024-27443, update your Zimbra Collaboration software to the latest version that includes the security patch.
Which versions of Zimbra Collaboration are affected by CVE-2024-27443?
CVE-2024-27443 affects Zimbra Collaboration versions 9.0.0 through 10.0.6.
What type of vulnerability is CVE-2024-27443?
CVE-2024-27443 is a Cross-Site Scripting (XSS) vulnerability in the CalendarInvite feature of Zimbra.
Can CVE-2024-27443 allow for unauthorized access?
Yes, an attacker can exploit CVE-2024-27443 to execute arbitrary scripts in the context of another user's session.
- agent/description
- agent/references
- agent/first-publish-date
- agent/type
- agent/author
- agent/event
- agent/severity
- agent/weakness
- agent/source
- agent/tags
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/zimbra
- canonical/zimbra collaboration suite
- version/zimbra collaboration suite/10.0.0
- version/zimbra collaboration suite/9.0.0
- version/zimbra collaboration suite/9.0.0-p0
- version/zimbra collaboration suite/9.0.0-p1
- version/zimbra collaboration suite/9.0.0-p10
- version/zimbra collaboration suite/9.0.0-p11
- version/zimbra collaboration suite/9.0.0-p12
- version/zimbra collaboration suite/9.0.0-p13
- version/zimbra collaboration suite/9.0.0-p14
- version/zimbra collaboration suite/9.0.0-p15
- version/zimbra collaboration suite/9.0.0-p16
- version/zimbra collaboration suite/9.0.0-p19
- version/zimbra collaboration suite/9.0.0-p2
- version/zimbra collaboration suite/9.0.0-p20
- version/zimbra collaboration suite/9.0.0-p21
- version/zimbra collaboration suite/9.0.0-p23
- version/zimbra collaboration suite/9.0.0-p24
- version/zimbra collaboration suite/9.0.0-p24.1
- version/zimbra collaboration suite/9.0.0-p25
- version/zimbra collaboration suite/9.0.0-p26
- version/zimbra collaboration suite/9.0.0-p27
- version/zimbra collaboration suite/9.0.0-p3
- version/zimbra collaboration suite/9.0.0-p30
- version/zimbra collaboration suite/9.0.0-p31
- version/zimbra collaboration suite/9.0.0-p32
- version/zimbra collaboration suite/9.0.0-p33
- version/zimbra collaboration suite/9.0.0-p34
- version/zimbra collaboration suite/9.0.0-p35
- version/zimbra collaboration suite/9.0.0-p36
- version/zimbra collaboration suite/9.0.0-p37
- version/zimbra collaboration suite/9.0.0-p38
- version/zimbra collaboration suite/9.0.0-p4
- version/zimbra collaboration suite/9.0.0-p5
- version/zimbra collaboration suite/9.0.0-p6
- version/zimbra collaboration suite/9.0.0-p7
- version/zimbra collaboration suite/9.0.0-p7.1
- version/zimbra collaboration suite/9.0.0-p8
- version/zimbra collaboration suite/9.0.0-p9