Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)
The flaw is a cross-site scripting vulnerability in the CalendarInvite feature of the Zimbra webmail classic user interface in Synacor's Zimbra Collaboration Suite (ZCS), caused by improper input validation of the calendar header. An attacker can send an email containing a crafted calendar header with an embedded script payload, which executes in the victim's session with arbitrary JavaScript when the victim views the message in the classic interface, requiring user interaction but no authentication.
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 4/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 9 months after disclosure.
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+9 mo
- Added to CISA KEVEU database agrees+9 mo
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
4 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 4Initial AccessTA0001
Attackers can send a malicious email with a specially crafted calendar header in order to execute arbitrary JavaScript code in the browser. This can lead to email collection, which can then be exfiltrated.
ExecutionTA0002
Attackers can send a malicious email with a specially crafted calendar header in order to execute arbitrary JavaScript code in the browser
CollectionTA0009
ExfiltrationTA0010
Detection
0 rules for this CVE · 32 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2024-27443 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Spearphishing LinkT1566.0024 general rules
- Potential Malicious Usage of CloudTrail System Managerhightest
- Suspicious Execution via macOS Script Editormediumtest
- Suspicious Email Delivered In Microsoft 365mediumexperimental
- EvilTokens PhaaS Kit Phishing Related Request - Proxylowexperimental
Unix ShellT1059.00419 general rules
- Linux Reverse Shell Indicatorcriticaltest
- AWS EC2 Startup Shell Script Changehightest
- Equation Group Indicatorshightest
- JexBoss Command Sequencehightest
- Shell Invocation via Env Command - Linuxhightest
- Suspicious Activity in Shell Commandshightest
- Suspicious Reverse Shell Command Linehightest
- Axios NPM Compromise Indicators - Linuxhighexperimental
Email CollectionT11144 general rules
- Exchange PowerShell Snap-Ins Usagehightest
- Hacktool Rulerhightest
- PST Export Alert Using eDiscovery Alertmediumtest
- PST Export Alert Using New-ComplianceSearchActionmediumtest
Exfiltration Over C2 ChannelT10415 general rules
- Equation Group C2 Communicationhightest
- OpenCanary - TFTP Requesthightest
- Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental
- Network Communication Initiated To Portmap.IO Domainmediumtest
- Tunneling Tool Executionmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 30, 202629 Oct 2026
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- 44 more on OTX