DaystoPatch

Zimbra (Synacor)Exploited incident

Zimbra CalendarInvite cross-site scripting used in Sednit's Operation RoundPress (CVE-2024-27443)

CVE-2024-27443Medium, CVSS 6.1In CISA's Known Exploited Vulnerabilities catalog since 19 May 2025

  • Exploited after a fix existed
FixedFixed for every supported version 189 days after the first public report.

Response

Silence
same day
First public report to first vendor statement
Exposure
same day
First public report to first fix
Follow-through
189d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.0.7 was released on Wed Feb 28 2024.

    Coordinated disclosure (reporters credited in Zimbra's table: nhiephon, chung96vn, SPT from NCSC Vietnam); the fix releases were the first public information. CVE record published 2024-08-12.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp
    3 more sources for this moment
    CVE.org record CVE-2024-27443ClaimedQuote verified12 Aug 2024, 00:00 UTC

    An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of the Zimbra webmail classic user interface,

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1c4c2cb4a5aa1fc0…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet12 Aug 2024, 15:15 UTC

    ID: CVE-2024-27443

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2024-27443)ClaimedQuote verified19 May 2025

    Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability

    Added to CISA's KEV catalog on 2025-05-19.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.0.7 was released on Wed Feb 28 2024.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    No official mitigation found yet.

  4. First fix

    date onlysame day

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 10.0.7 was released on Wed Feb 28 2024.

    The 10.0.7 entry lists 'An XSS vulnerability in a Calendar invite has been resolved. CVE-2024-27443'; 9.0.0 Patch 39 was released the same day ('ZCS 9.0.0 Patch 39 was released on Wed Feb 28 2024.'). wiki.zimbra.com was in maintenance on 2026-10-22, so a Wayback capture is cited.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date only+189d

    Zimbra Security Center (Wayback snapshot)CuratedQuote verified

    ZCS 8.8.15 Patch 46 was released on Wed Sep 04 2024.

    Zimbra's advisories table lists 8.8.15 Patch 46 as a fix release for CVE-2024-27443 alongside 9.0.0 Patch 39 and 10.0.7, and the 8.8.15 Patch 46 entry includes CVE-2024-27443. The 8.8.15 branch was therefore fixed about six months after the others.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:c12fa055432dba11…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.

Affected products

  • Zimbra Collaboration Suite 9.0.0 before Patch 39, 10.0 before 10.0.7, 8.8.15 before Patch 46 (Classic web client)
How we built this timeline

ESET (Operation RoundPress, 2025-05) says Sednit used CVE-2024-27443 against Zimbra webmail during 2024 and that it 'was patched on March 1st, 2024 in this GitHub commit'; ESET calls only the MDaemon bug a zero-day.

No report of exploitation before Zimbra's 28 Feb 2024 releases was found, so exploited before a fix=false; whether 8.8.15 users were attacked during the 28 Feb 2024 to 4 Sep 2024 gap is unknown. ESET's 1 Mar 2024 GitHub commit date conflicts slightly with Zimbra's 28 Feb 2024 release date;

Zimbra's release date is used. The CVE record says '9.0 and 10.0', but Zimbra's own table also lists an 8.8.15 fix.

CVSS 6.1 is Zimbra's score in its advisories table (same as CISA-ADP).

Related

No related incidents.

Zimbra (Synacor) report card