CVE-2024-27443

MEDIUM

6.1

CVSS Score

Published: August 12, 2024 at 12:00 AM UTC

Updated: June 17, 2026 at 07:19 AM UTC

1 product affected across 1 vendorCollaboration

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.1

Exploitation

CISA KEV

Exploit prediction

EPSS 25%

SSVC

Active

Actively Exploited

CISA Known Exploited Vulnerabilities (KEV) Catalog

EPSS Score24.6%

EPSS (Exploit Prediction Scoring System) estimates a 24.6% chance this CVE is exploited in the wild within the next 30 days — higher than 98% of all CVEs. It complements CVSS: a high EPSS on a mid-severity CVE can still be urgent.

Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code.

Required Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Ransomware Use

Unknown

Added to KEV

May 19, 2025

Remediation Due

Jun 9, 2025

508 days overdue

Notes

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes

https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes

https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes

https://nvd.nist.gov/vuln/detail/CVE-2024-27443

Description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.