CVE-2022-24682
CISA 기관 조치 기한: 2022-03-11
Synacor Zimbra Collaborate Suite (ZCS)
An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
KEV 필수 조치: Apply updates per vendor instructions.
타임라인
- NVD 공개
- CISA KEV 등재(실제 악용 확인) 공개 후 16일
- CISA 기관 조치 기한 경과
날짜 정보 없는 신호: 랜섬웨어 캠페인 악용
벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N