Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSynacor Zimbra Collaboration Suite
APPSynacor8.8.159.0.0
CISA KEV — szczegółyi
- Dostawcai
- Synacor
- Produkti
- Zimbra Collaboration Suite (ZCS)
- Data dodania do KEVi
- 11 sierpnia 2022
- Termin remediation (USA)i
- 1 września 2022(po terminie)
- Ransomwarei
- Aktywne kampanie ransomware używają tej podatności
Zastosuj aktualizacje zgodnie z instrukcjami producenta.
▸ Pokaż oryginał (EN)
Apply updates per vendor instructions.
Synacor Zimbra Collaboration Suite (ZCS) zawiera lukę uwierzytelniania w MailboxImportServlet. Ta luka została połączona z CVE-2022-27925, co umożliwia unauthenticated RCE.
▸ Pokaż oryginał (EN)
Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.
Powiązane podatności
RCE w usłudze postjournal Zimbra Collaboration Suite — command injection bez uwierzytelnienia
Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute ar...
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files t...
Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet J...
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity inj...