CVE-2022-24682

Zimbra Collaborate Suite has a critical XSS vulnerability actively exploited by ransomware actors, demonstrating poor vulnerability management by Synacor.

A cross-site scripting (XSS) vulnerability in Zimbra's Calendar feature allows arbitrary code execution, actively exploited in ransomware attacks. DIB organizations using Zimbra face potential data compromise and compliance failures (NIST 800-171 controls 3.1.1, 3.1.2, 3.1.3). Immediate patching and vulnerability management process review are essential.

Shame score — Synacor's chronic failure to patch critical vulnerabilities, leading to active exploitation by ransomware, reflects significant negligence.