An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
| Link | Tags |
|---|---|
| https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories | vendor advisory |
| https://wiki.zimbra.com/wiki/Security_Center | vendor advisory |
| https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/ | third party advisory exploit |
| https://blog.zimbra.com/2022/02/hotfix-available-5-feb-for-zero-day-exploit-vulnerability-in-zimbra-8-8-15/ | vendor advisory |
| https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P30 | release notes vendor advisory |