# CVE-2024-27443: Zimbra Collaboration - XSS

> Live exploitation tracking for CVE-2024-27443 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-27443

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.1
- **Public exploit available:** Yes
- **Affected products:** Zimbra Collaboration
- **Weaknesses:** CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
- **Tags:** web_application, enterprise_software

## Description

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface, because of improper input validation in the handling of the calendar header. An attacker can exploit this via an email message containing a crafted calendar header with an embedded XSS payload. When a victim views this message in the Zimbra webmail classic interface, the payload is executed in the context of the victim's session, potentially leading to execution of arbitrary JavaScript code.

## CrowdSec analysis

[CVE-2024-27443](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-27443) is a cross-site scripting (XSS) vulnerability in the CalendarInvite feature of Zimbra Collaboration Suite (ZCS) versions 9.0 and 10.0. By sending a specially crafted email with a malicious calendar header, attackers can execute arbitrary JavaScript in the victim's browser when the message is viewed in the classic webmail interface. This flaw could be exploited to steal session cookies, impersonate users, or perform unauthorized actions within the victim's session.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-27443 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending crafted calendar invites via email to Zimbra users, embedding malicious scripts in calendar headers to trigger XSS when the invite is viewed in the classic webmail interface. The targeted endpoint is the CalendarInvite feature within Zimbra Collaboration Suite versions 9.0 and 10.0.

## Timeline

- 2024-08-12: CVE Published. CVE-2024-27443 is published to NVD.
- 2025-05-19: CISA KEV. CVE-2024-27443 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-06-09: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-11-26: Rule Released. CrowdSec releases a rule to detect CVE-2024-27443 exploitation attempts against the CrowdSec Network.

## References

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-27443
- https://www.welivesecurity.com/en/eset-research/operation-roundpress/
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-27443.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-27443) follows observed exploitation activity for CVE-2024-27443. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.