Skip to content
Fencer Intel
medium 6.1

CVE-2022-24682 kev+ ransomware in the critical feed json

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the…

published 4y ago modified 3mo ago also EUVD-2022-29554

cvss
6.1
version 3.1, CNA
cisa kev
Exploited
added 2022-02-25, used in ransomware
epss
30.9%
EPSS 30.9% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known, plus a Nuclei check

Summary

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • synacor zimbra_collaboration_suite 8.8.15

Is CVE-2022-24682 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

  1. Found exploited as a 0-day (Project Zero)
  2. CISA SSVC: exploitation active
  3. 0-day patched (Project Zero)
  4. Published
  5. Added to CISA KEV
  6. CISA patch deadline

Known exploited

Added
4y ago
Patch by
2022-03-11 (4y ago)
Ransomware
Known to be used in ransomware campaigns
Required action
Apply updates per vendor instructions.
Vendor, product
Synacor, Zimbra Collaborate Suite (ZCS)
CISA name
Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Found
2021-12-16
Patched
2022-02-05
Details
project zero tracker

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1204.001 Malicious Link exploitation
  • T1059.007 JavaScript primary impact
  • T1185 Browser Session Hijacking secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
partial
Assessed
4y ago

Exploit prediction

30.93% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • Nuclei template Zimbra Collaboration Suite < 8.8.15 - Improper Encoding nuclei detection template
  • volexity.com https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CNA 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-116 Improper Encoding or Escaping of Output

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.