Veille CVE
CVE-2022-24682
6.1 Moyenne Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability
Ajoutée le 25/02/2022 · Échéance de correction (agences US) : 11/03/2022
Action requise : Apply updates per vendor instructions.
Description
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 6.1 Moyenne | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| 3.1 | 6.1 Moyenne | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| 2.0 | 4.3 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Faiblesses (CWE)
Références
- https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/ Vendor Advisory
- https://wiki.zimbra.com/wiki/Security_Center Vendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30 Release NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/ ExploitThird Party Advisory
- https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/ Vendor Advisory
- https://wiki.zimbra.com/wiki/Security_Center Vendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30 Release NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/ ExploitThird Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24682 US Government Resource