CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2022-09-26
Zimbra Collaboration Suite (ZCS) Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2022-41352)
[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0 running on Red Hat-based distributions (RHEL/CentOS) where the 'pax' utility is missing.
[Impact] Unauthenticated attackers can upload arbitrary files to the web root directory via a cpio path traversal loophole during amavis scanning, leading to full system compromise.
[Mitigation] Immediately install the 'pax' utility via the OS package manager or upgrade Zimbra to the latest patched version.