{"identifier":"CVE-2024-27443","cve":{"id":"CVE-2024-27443","description":"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.","published":"2024-08-12T15:15:20.283000+00:00","modified":"2026-06-17T07:19:54.627000+00:00","status":"Analyzed","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_version":"3.1","affected":[{"criteria":"cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":"10.0.7"},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""},{"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*","versionStartIncluding":"","versionStartExcluding":"","versionEndIncluding":"","versionEndExcluding":""}],"weaknesses":["CWE-79"],"references":[{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes","source":"cve@mitre.org","tags":["Release Notes"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27443","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["US Government Resource"]},{"url":"https://www.welivesecurity.com/en/eset-research/operation-roundpress/","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Press/Media Coverage"]}],"kev":{"cveID":"CVE-2024-27443","vendorProject":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","vulnerabilityName":"Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability","dateAdded":"2025-05-19","shortDescription":"Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code.","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","dueDate":"2025-06-09","knownRansomwareCampaignUse":"Unknown","forensicTriage":"No","notes":"https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes ; https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes ; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes ; https://nvd.nist.gov/vuln/detail/CVE-2024-27443","cwes":["CWE-79"]},"kev_checked":true,"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-05-21T03:55:36.220790Z","id":"CVE-2024-27443","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*","versionStartIncluding":"10.0.0","versionEndExcluding":"10.0.7","matchCriteriaId":"4CE0029A-44EA-4774-879D-5FA2D35F09BD"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*","matchCriteriaId":"685D9652-2934-4C13-8B36-40582C79BFC1"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*","matchCriteriaId":"5E4DF01A-1AA9-47E8-82FD-65A02ECA1376"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*","matchCriteriaId":"BDE59185-B917-4A81-8DE4-C65A079F52FE"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*","matchCriteriaId":"BA3ED95F-95F2-4676-8EAF-B4B9EB64B260"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*","matchCriteriaId":"4BB93336-CC3C-4B7F-B194-7DED036ABBAF"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*","matchCriteriaId":"876F1675-F65C-4E86-ADBD-36EB8D8A997D"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*","matchCriteriaId":"2306F526-9C56-4A57-AA9B-02F2D6058C97"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*","matchCriteriaId":"F9EA2A61-67AA-4B7E-BC6E-80EB1363EF85"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*","matchCriteriaId":"C77A35B7-96F6-43A7-A747-C6AEEDE961E1"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*","matchCriteriaId":"DC35882B-E709-42D8-8800-F1B734CEAFC3"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*","matchCriteriaId":"B7A47276-F241-4A68-9458-E1481EBDC5E6"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*","matchCriteriaId":"12D0D469-6C9B-4B66-9581-DC319773238A"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*","matchCriteriaId":"40629BEB-DF4B-4FB8-8D3D-7BAC43C90766"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*","matchCriteriaId":"9503131F-CC23-4545-AE9C-9714B287CC25"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*","matchCriteriaId":"B4CE2D12-AD31-4FED-AD0F-ADF64E92E1B1"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*","matchCriteriaId":"8113A4E3-AA96-4382-815D-6FD88BA42EC5"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*","matchCriteriaId":"DC8C28E0-6C51-41EE-A7B2-DB185D1D8FD0"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*","matchCriteriaId":"BC19F11D-23D9-429D-A957-D67F23A40A01"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*","matchCriteriaId":"AAFA2EE7-C965-4F27-8CAE-E607A9F202AD"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*","matchCriteriaId":"1D09DCF6-1C8F-4CA1-B7D4-AFDD4EB35771"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*","matchCriteriaId":"C52705E6-2C6B-47BC-A0CD-F6AAE0BFC302"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*","matchCriteriaId":"FD1DCE2B-D944-43AE-AD0E-9282DE6D618F"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*","matchCriteriaId":"2079B9F8-128B-487D-A965-E8B37FDF6304"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*","matchCriteriaId":"9679FD62-815E-47A8-8552-D28CE48B82B2"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*","matchCriteriaId":"D659AE6A-591E-4D5B-9781-9648250F5576"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*","matchCriteriaId":"E4054E3E-561C-4B1C-A615-3CCE5CB69D77"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*","matchCriteriaId":"4FA0E9C4-25E4-4CD6-B88A-02B413385866"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*","matchCriteriaId":"5D6F7CA3-C36A-466C-8FAD-D0B3CEF01F0E"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*","matchCriteriaId":"9684AC81-B557-4292-8402-AE55CB2E613C"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*","matchCriteriaId":"32A352C4-0E9C-436F-ADA7-D93492A18037"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*","matchCriteriaId":"33F50D8C-7027-4A8D-8E95-98C224283772"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*","matchCriteriaId":"82000BA4-1781-4312-A7BD-92EC94D137AE"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*","matchCriteriaId":"4B52D301-2559-457A-8FFB-F0915299355A"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*","matchCriteriaId":"7215AE2C-8A33-4AB9-88D5-7C8CD11E806C"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*","matchCriteriaId":"8D859F77-8E39-4D46-BC90-C5C1D805A666"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*","matchCriteriaId":"CDC810C7-45DA-4BDF-9138-2D3B2750243E"},{"vulnerable":true,"criteria":"cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*","matchCriteriaId":"E09D95A4-764D-4E0B-8605-1D94FD548AB2"}]}]}],"source":"nvd","retrieved_at":"2026-10-28T16:18:10.487235+00:00","exploited":true,"kev_stale":false,"products":["zimbra / collaboration"],"priority":{"label":"Known exploitation: prioritize review","reasons":["CISA KEV lists real-world exploitation."]},"epss":{"probability":0.24606,"percentile":0.97876,"date":"2026-10-28","stale":false},"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"wiki.zimbra.com","source_url":"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes","investigate_url":"https://investigate.aeglixmind.com/#wiki.zimbra.com"},{"domain":"www.cisa.gov","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27443","investigate_url":"https://investigate.aeglixmind.com/#www.cisa.gov"},{"domain":"www.welivesecurity.com","source_url":"https://www.welivesecurity.com/en/eset-research/operation-roundpress/","investigate_url":"https://investigate.aeglixmind.com/#www.welivesecurity.com"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2024-27443","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2024-27443","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2024-27443","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}