CVE-2024-27443

Published: Aug 12, 2024Updated: Oct 31, 2025 Sources: CVE List NVD BDUCWE-79

NVD MITRE

6.1CVSSMEDIUM

EPSS Score

Am I actually vulnerable?1 Nuclei template available — see how to check your systems. How to verify

Description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:RUser Interaction

Required

Scope

S:CScope

Changed

Impact

C:LConfidentiality

Low

I:LIntegrity

Low

A:NAvailability

None

Open in CVSS calculator →

Weaknesses

CWE-79

Affected Products

n/a n/a

collaboration zimbra

On-premDesktop App

Enterprise Software / collaboration-groupware

Zimbra Collaboration Suite Zimbra Inc.

Mixed

Communications / email-server-client

zimbracommercialEnterprise Softwareaka zimbra collaboration server

zimbra inc.commercialUSCommunications

Attack Graph

Products CVE Techniques Tactics

Click technique nodes to view MITRE ATT&CK details. Scroll to zoom, drag to pan.

Exploitability

CISA Known Exploited Vulnerability

Added to KEV:May 19, 2025

Remediation due:Jun 9, 2025

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Official Patch Available