CVE-2022-24682

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-24682
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24682.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-24682
Published
2022-02-09T03:19:04Z
Modified
2026-07-15T00:27:32.178829Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starting in December 2021. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24682.json",
    "cna_assigner": "mitre",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "8.8.x"
                },
                {
                    "fixed": "8.8.15"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
References

Affected packages

Git
github.com/zimbra/zm-build

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-build
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ac6081fa002b1511e926aba37740d2b6c20f3f43
Introduced
ac6081fa002b1511e926aba37740d2b6c20f3f43
Database specific 
{
    "extracted_events": [
        {
            "introduced": "8.8.0"
        },
        {
            "fixed": "8.8.15"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p1"
        },
        {
            "last_affected": "8.8.15-p1"
        },
        {
            "introduced": "8.8.15-p11"
        },
        {
            "last_affected": "8.8.15-p11"
        },
        {
            "introduced": "8.8.15-p20"
        },
        {
            "last_affected": "8.8.15-p20"
        },
        {
            "introduced": "8.8.15-p26"
        },
        {
            "last_affected": "8.8.15-p26"
        },
        {
            "introduced": "8.8.15-p3"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "8.8.15-p5"
        },
        {
            "last_affected": "8.8.15-p5"
        }
    ],
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

8.*
8.8.15-NA
8.8.15-p1
8.8.15-p20
8.8.15-p26
8.8.15-p3
8.8.15-p5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24682.json"
github.com/zimbra/zm-mailbox

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-mailbox
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d30e647f21ecef5490f21facf2e06e228b44a36e
Introduced
d30e647f21ecef5490f21facf2e06e228b44a36e
Database specific 
{
    "extracted_events": [
        {
            "introduced": "8.8.0"
        },
        {
            "fixed": "8.8.15"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p1"
        },
        {
            "last_affected": "8.8.15-p1"
        },
        {
            "introduced": "8.8.15-p10"
        },
        {
            "last_affected": "8.8.15-p10"
        },
        {
            "introduced": "8.8.15-p11"
        },
        {
            "last_affected": "8.8.15-p11"
        },
        {
            "introduced": "8.8.15-p12"
        },
        {
            "last_affected": "8.8.15-p12"
        },
        {
            "introduced": "8.8.15-p13"
        },
        {
            "last_affected": "8.8.15-p13"
        },
        {
            "introduced": "8.8.15-p14"
        },
        {
            "last_affected": "8.8.15-p14"
        },
        {
            "introduced": "8.8.15-p15"
        },
        {
            "last_affected": "8.8.15-p15"
        },
        {
            "introduced": "8.8.15-p16"
        },
        {
            "last_affected": "8.8.15-p16"
        },
        {
            "introduced": "8.8.15-p17"
        },
        {
            "last_affected": "8.8.15-p17"
        },
        {
            "introduced": "8.8.15-p18"
        },
        {
            "last_affected": "8.8.15-p18"
        },
        {
            "introduced": "8.8.15-p2"
        },
        {
            "last_affected": "8.8.15-p2"
        },
        {
            "introduced": "8.8.15-p20"
        },
        {
            "last_affected": "8.8.15-p20"
        },
        {
            "introduced": "8.8.15-p23"
        },
        {
            "last_affected": "8.8.15-p23"
        },
        {
            "introduced": "8.8.15-p24"
        },
        {
            "last_affected": "8.8.15-p24"
        },
        {
            "introduced": "8.8.15-p25"
        },
        {
            "last_affected": "8.8.15-p25"
        },
        {
            "introduced": "8.8.15-p26"
        },
        {
            "last_affected": "8.8.15-p26"
        },
        {
            "introduced": "8.8.15-p27"
        },
        {
            "last_affected": "8.8.15-p27"
        },
        {
            "introduced": "8.8.15-p29"
        },
        {
            "last_affected": "8.8.15-p29"
        },
        {
            "introduced": "8.8.15-p3"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "8.8.15-p4"
        },
        {
            "last_affected": "8.8.15-p4"
        },
        {
            "introduced": "8.8.15-p5"
        },
        {
            "last_affected": "8.8.15-p5"
        },
        {
            "introduced": "8.8.15-p6"
        },
        {
            "last_affected": "8.8.15-p6"
        },
        {
            "introduced": "8.8.15-p7"
        },
        {
            "last_affected": "8.8.15-p7"
        },
        {
            "introduced": "8.8.15-p8"
        },
        {
            "last_affected": "8.8.15-p8"
        },
        {
            "introduced": "8.8.15-p9"
        },
        {
            "last_affected": "8.8.15-p9"
        }
    ],
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

8.*
8.8.10
8.8.12
8.8.15-NA
8.8.15-p1
8.8.15-p10
8.8.15-p11
8.8.15-p12
8.8.15-p13
8.8.15-p14
8.8.15-p15
8.8.15-p16
8.8.15-p17
8.8.15-p18
8.8.15-p2
8.8.15-p20
8.8.15-p23
8.8.15-p24
8.8.15-p25
8.8.15-p26
8.8.15-p27
8.8.15-p29
8.8.15-p3
8.8.15-p4
8.8.15-p5
8.8.15-p6
8.8.15-p7
8.8.15-p8
8.8.15-p9
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.8.7
8.8.8
8.8.9

Database specific

vanir_signatures 
[
    {
        "signature_type": "Function",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "length": 461.0,
            "function_hash": "130804680382483964301386928646396783356"
        },
        "source": "https://github.com/zimbra/zm-mailbox/commit/d30e647f21ecef5490f21facf2e06e228b44a36e",
        "id": "CVE-2022-24682-4314dc38",
        "target": {
            "function": "updateLastLogon",
            "file": "store/src/java/com/zimbra/cs/account/ldap/LdapProvisioning.java"
        }
    },
    {
        "signature_type": "Line",
        "deprecated": false,
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "35532726304441886843822597725517922529",
                "86869606749296562789619135716824747966",
                "329209388892522800440224682947664957145",
                "301198994465565842404478996247629867721",
                "249110717571679374632676844697594286961",
                "165150619554600532748713227738510509377",
                "135793442757343879754509969633552703576",
                "99023990949396355242231588957425096724"
            ],
            "threshold": 0.9
        },
        "source": "https://github.com/zimbra/zm-mailbox/commit/d30e647f21ecef5490f21facf2e06e228b44a36e",
        "id": "CVE-2022-24682-96c6e311",
        "target": {
            "file": "store/src/java/com/zimbra/cs/account/ldap/LdapProvisioning.java"
        }
    }
]
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24682.json"
vanir_signatures_modified 
"2026-07-15T00:27:32Z"
github.com/zimbra/zm-zcs

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-zcs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
6c72db05e6f1b89c511ba5c08ec4b6399bec7bb6
Introduced
6c72db05e6f1b89c511ba5c08ec4b6399bec7bb6
Database specific 
{
    "extracted_events": [
        {
            "introduced": "8.8.0"
        },
        {
            "fixed": "8.8.15"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p6"
        },
        {
            "last_affected": "8.8.15-p6"
        }
    ],
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

8.*
8.7.10
8.7.11
8.7.6
8.7.7
8.7.9
8.8.0.beta1
8.8.0beta2
8.8.10
8.8.11
8.8.12
8.8.15-NA
8.8.15-p6
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.8.7
8.8.8
8.8.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24682.json"
github.com/zimbra/zm-zcs-lib

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-zcs-lib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
41db44a222b547dcc89ab50273cb8684195c09c2
Introduced
41db44a222b547dcc89ab50273cb8684195c09c2
Database specific 
{
    "extracted_events": [
        {
            "introduced": "8.8.0"
        },
        {
            "fixed": "8.8.15"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p20"
        },
        {
            "last_affected": "8.8.15-p20"
        },
        {
            "introduced": "8.8.15-p21"
        },
        {
            "last_affected": "8.8.15-p21"
        },
        {
            "introduced": "8.8.15-p23"
        },
        {
            "last_affected": "8.8.15-p23"
        },
        {
            "introduced": "8.8.15-p24"
        },
        {
            "last_affected": "8.8.15-p24"
        },
        {
            "introduced": "8.8.15-p3"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "8.8.15-p5"
        },
        {
            "last_affected": "8.8.15-p5"
        }
    ],
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

8.*
8.7.6
8.7.7
8.8.15-NA
8.8.15-p20
8.8.15-p21
8.8.15-p23
8.8.15-p24
8.8.15-p3
8.8.15-p5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-24682.json"