CVE-2022-24682

01/תיאור (מקור, אנגלית)

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

02/מוצרים מושפעים

synacor: zimbra collaboration suite

03/קישורים10

• blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-ex‮… Vendor Advisory
• wiki.zimbra.com/wiki/Security_Center Vendor Advisory
• wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30 Release NotesVendor Advisory
• wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
• blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-ex‮… Vendor Advisory
• wiki.zimbra.com/wiki/Security_Center Vendor Advisory
• wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30 Release NotesVendor Advisory
• wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
• www.volexity.com/blog/2022/02/03/operation-emailthief-active-e‮… ExploitThird Party Advisory
• www.volexity.com/blog/2022/02/03/operation-emailthief-active-e‮… ExploitThird Party Advisory