CVE-2022-24682

A vulnerability in Zimbra's Calendar feature allows attackers to inject malicious JavaScript code through HTML in calendar elements. This can lead to unauthorized actions being performed in a user's calendar or account when they view the affected content.

The vulnerability exists in the Calendar feature where user-supplied input in element attributes is not properly escaped before being rendered in the DOM, resulting in HTML/JavaScript injection (CWE-116). An attacker can craft malicious calendar entries or events containing JavaScript payloads that execute in the context of a victim's browser session, potentially leading to session hijacking, account compromise, or unauthorized calendar modifications.