mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSynacor Zimbra Collaboration Suite
APPSynacor8.7.118.7.0 – 8.7.11 (excl.)
CISA KEV — detailsi
- Vendori
- Synacor
- Producti
- Zimbra Collaboration Suite (ZCS)
- Added to KEVi
- January 10, 2022
- Remediation deadline (US Federal)i
- July 10, 2022(overdue)
Required action (CISA)i
Apply updates per vendor instructions.
CISA descriptioni
Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.
🔴
IMMEDIATE ACTION
Actively exploited in the wild (CISA KEV). Patch immediately.
⏰CISA DEADLINE: 10 lipca 2022
Tags
XXE
References
Related vulnerabilities
CVE-2024-45519CRITICAL10.0⚠ KEVPL ✓same product
RCE w usłudze postjournal Zimbra Collaboration Suite — command injection bez uwierzytelnienia
CVE-2023-34192CRITICAL9.0⚠ KEVPL ✓same product
XSS umożliwiający RCE w Zimbra Collaboration Suite 8.8.15
CVE-2022-41352CRITICAL9.8⚠ KEVPL ✓same product
Zimbra Collaboration – path traversal przez cpio umożliwia przejęcie kont
CVE-2022-37042CRITICAL9.8⚠ KEVPL ✓same product
Zimbra ZCS: path traversal i RCE poprzez obejście uwierzytelnienia w mboximport
CVE-2020-7796CRITICAL9.8⚠ KEVPL ✓same product
SSRF w Zimbra Collaboration Suite przez WebEx zimlet