CVE-2024-45519

The postjournal service in Zimbra Collaboration Suite contains a command injection vulnerability (CWE-78), which under certain conditions allows unauthenticated users to execute system commands on the server. An attacker can send a specially crafted request to the postjournal service without needing any authentication credentials. Due to the lack of authentication and network accessibility of the service, the vulnerability is exceptionally easy to exploit.

An attacker can gain full control of the server by executing arbitrary system commands with Zimbra service privileges, leading to compromise of confidentiality, integrity, and availability of the system and potentially all stored email data.

Zimbra Collaboration Suite must be immediately updated to one of the following versions containing security patches: 8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9, or 10.1.1. Detailed information is available in the official Zimbra Security Center and in the release notes for individual versions.

Synacor Zimbra Collaboration Suite (ZCS) in versions: prior to 8.8.15 Patch 46, 9.x prior to 9.0.0 Patch 41, 10.x prior to 10.0.9, and 10.1.x prior to 10.1.1

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.