Is CVE-2022-24682 exploited in the wild?

Yes. CVE-2022-24682 is known to be exploited in the wild, first recorded on 25 February 2022. Treat it as urgent.

How severe is CVE-2022-24682?

Critical severity, with a CVSS score of 6.1, published 25 February 2022.

Which products and versions are affected?

Synacor Zimbra Collaboration Suite (ZCS) 8.8.x before 8.8.15 patch 30 (update 1).

Is there a fix for CVE-2022-24682?

A patch was published on 2022-02-05: Hotfix available for zero-day exploit. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-24682 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2022-24682?

Check whether you run Synacor Zimbra Collaborate Suite (ZCS). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-24682: Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability

CVE-2022-24682 · Severity: critical · CVSS 6.1 · Exploited in the wild · Published 2022-02-25

A cross-site scripting (XSS) vulnerability in the Calendar feature of Zimbra Collaboration Suite allows attackers to inject arbitrary HTML and executable JavaScript via element attributes. This occurs because markup becomes unescaped, leading to arbitrary code execution in the context of the user's session.

Vendors: Synacor.

Quick answers

Is CVE-2022-24682 exploited in the wild?: Yes. CVE-2022-24682 is known to be exploited in the wild, first recorded on 25 February 2022. Treat it as urgent.
How severe is CVE-2022-24682?: Critical severity, with a CVSS score of 6.1, published 25 February 2022.
Which products and versions are affected?: Synacor Zimbra Collaboration Suite (ZCS) 8.8.x before 8.8.15 patch 30 (update 1).
Is there a fix for CVE-2022-24682?: A patch was published on 2022-02-05: Hotfix available for zero-day exploit. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-24682 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2022-24682?: Check whether you run Synacor Zimbra Collaborate Suite (ZCS). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Affected products

Synacor Zimbra Collaboration Suite (ZCS) 8.8.x before 8.8.15 patch 30 (update 1)

Timeline

2021-12: exploited: Exploitation in the wild started in December 2021.
2022-02-05: patched: Hotfix available for zero-day exploit.
2022-02-25: disclosed: Published to NVD.
2022-02-25: kev added: Added to CISA Known Exploited Vulnerabilities Catalog.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.