EXPOSURES › CVE-2024-27443

CVE-2024-27443

HIGH ⌖ ON CISA KEV · EXPLOITED

DETAIL

SourceCISA-KEV · kev Published2025-05-19 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2024-27443 ↗

⚡ RCE ⌖ EXPLOITED IN THE WILD SHAME 72/100 exploited-in-wildunpatched

Synacor's Zimbra Collaboration Suite (ZCS) had an unpatched XSS vulnerability actively exploited by ransomware

Synacor's Zimbra Collaboration Suite (ZCS) had an unpatched XSS vulnerability that was actively exploited by ransomware, allowing attackers to execute arbitrary JavaScript code via crafted calendar headers in email messages.

Shame score — Chronic vulnerability management failure leading to critical flaws remaining unpatched and actively exploited by ransomware

▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.

PLAYERS IMPLICATED

Synacor · vendor Zimbra Collaboration Suite (ZCS) · product

DESCRIPTION

Zimbra Collaboration contains a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface. An attacker can exploit this vulnerability via an email message containing a crafted calendar header, leading to the execution of arbitrary JavaScript code.

AFFECTED FEDRAMP PRODUCTS · 0

No correlated FedRAMP products.