CVE Vulnerability Advisory Database

[Affected Scope] Zimbra Collaboration (ZCS) versions prior to 10.1.20, specifically when the optional zimbra-snmp package is installed and SNMP notifications are enabled.

[Impact] An unauthenticated remote attacker can execute arbitrary operating system commands as the Zimbra user by sending specially crafted SMTP requests.

[Mitigation] Immediately upgrade Zimbra Collaboration to version 10.1.20 or later, or temporarily disable the zimbra-snmp service.

[Affected Scope] Zimbra Collaboration (ZCS) versions before 10.0.18 and 10.1 versions before 10.1.13

[Impact] Attackers can execute arbitrary JavaScript code and steal session tokens in the context of the Classic UI when a user views a malicious HTML email.

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to the patched versions (10.0.18, 10.1.13, or later).

[Affected Scope] Zimbra Collaboration (ZCS) versions 10.0 and 10.1 utilizing the Webmail Classic UI

[Impact] Unauthenticated remote attackers can exploit the /h/rest endpoint to include and execute arbitrary files from the WebRoot directory, potentially leading to sensitive information disclosure and Remote Code Execution (RCE)

[Mitigation] Immediately apply the official security patches from Zimbra, or restrict external access to the vulnerable /h/rest endpoint as a temporary workaround

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15, 9.0, 10.0, and 10.1 utilizing the Classic UI

[Impact] Attackers can execute arbitrary JavaScript within the victim's session by sending a crafted email, potentially leading to session hijacking and unauthorized access to sensitive data without requiring user interaction beyond viewing the email

[Mitigation] Immediately apply the latest security patches provided by Zimbra, or temporarily restrict the use of the Classic UI and deploy WAF rules

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0, 10.0, and 10.1 utilizing the Classic Web Client

[Impact] Viewing an email containing a malicious ICS calendar file triggers arbitrary JavaScript execution within the victim's session, enabling unauthorized email redirection and data exfiltration

[Mitigation] Apply official Zimbra security patches (9.0.0 Patch 44, 10.0.13, 10.1.5 or later) immediately, and restrict the use of the Classic Web Client until patched

[Affected Scope] Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1

[Impact] Unauthenticated remote attackers can execute arbitrary system commands and fully compromise the target server by sending specially crafted inputs to the postjournal service.

[Mitigation] Immediately upgrade Zimbra to the latest patched versions (8.8.15 P46, 9.0.0 P41, 10.0.9, 10.1.1 or later), or disable the postjournal service if not required.

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 9.0 and 10.0 utilizing the classic webmail user interface.

[Impact] Successful exploitation allows remote attackers to execute arbitrary JavaScript code in the context of the victim's browser session, potentially leading to session hijacking and unauthorized data access.

[Mitigation] Apply official security patches (9.0.0 Patch 39, 10.0.7 or higher) immediately, or restrict access to the classic UI.

[Affected Scope] Zimbra Collaboration Suite (ZCS) 8.8.15 versions prior to Patch 41 utilizing the Classic Web Client

[Impact] Attackers can execute arbitrary JavaScript in the victim's browser session, leading to session hijacking, credential theft, and unauthorized access to mailboxes

[Mitigation] Apply the official Zimbra security patch (8.8.15 Patch 41 or higher) immediately, or implement WAF rules to block malicious query parameters

[Affected Scope] Zimbra Collaboration Suite (ZCS) version 8.8.15

[Impact] A remote authenticated attacker can execute arbitrary code and hijack sessions by injecting malicious scripts into the '/h/autoSaveDraft' function

[Mitigation] Immediately apply the official Zimbra security patches and restrict access to the affected endpoint using WAF rules

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0 running on Red Hat-based distributions (RHEL/CentOS) where the 'pax' utility is missing.

[Impact] Unauthenticated attackers can upload arbitrary files to the web root directory via a cpio path traversal loophole during amavis scanning, leading to full system compromise.

[Mitigation] Immediately install the 'pax' utility via the OS package manager or upgrade Zimbra to the latest patched version.

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0

[Impact] Unauthenticated attackers can bypass authentication, upload malicious ZIP archives, and exploit directory traversal to write arbitrary files, leading to Remote Code Execution (RCE)

[Mitigation] Immediately apply the official Zimbra security patches and restrict external access to the mboximport endpoint

[Affected Scope] RARLAB UnRAR utility versions prior to 6.12 on Linux and UNIX platforms.

[Impact] Attackers can exploit this vulnerability to write arbitrary files outside the extraction directory, potentially leading to Remote Code Execution (RCE).

[Mitigation] Immediately upgrade UnRAR to version 6.12 or later, and apply security patches to integrated applications like Zimbra.

[Affected Scope] Zimbra Collaboration Suite (ZCS) 9.0.0 versions prior to Patch 24

[Impact] Unauthenticated attackers can execute arbitrary web scripts or HTML in the victim's browser session, potentially hijacking active sessions and accessing sensitive mailboxes

[Mitigation] Immediately upgrade to Zimbra 9.0.0 Patch 24 or later, and apply temporary WAF rules to block access to the vulnerable endpoint

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0

[Impact] An authenticated administrator can upload a malicious ZIP archive to write arbitrary files, leading to Remote Code Execution (RCE)

[Mitigation] Immediately apply the official Zimbra security patches (9.0.0 Patch 24 / 8.8.15 Patch 31 or later)

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions 8.8.15 and 9.0.

[Impact] Unauthenticated remote attackers can inject arbitrary Memcached commands, leading to cache poisoning, session hijacking, and credential theft.

[Mitigation] Immediately apply the official Zimbra security patches (9.0.0 Patch 24 / 8.8.15 Patch 31 or higher).

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions prior to 8.8.15 Patch 7 with WebEx zimlet installed and zimlet JSP enabled

[Impact] Unauthenticated remote attackers can exploit Server-Side Request Forgery (SSRF) to access internal network resources, extract sensitive data, or pivot to further remote code execution (RCE)

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to 8.8.15 Patch 7 or later, or disable and undeploy the unused WebEx zimlet

[Affected Scope] Zimbra Collaboration Suite before 8.6 Patch 13, 8.7.x before 8.7.11 Patch 10, and 8.8.x before 8.8.10 Patch 7 or 8.8.x before 8.8.11 Patch 3

[Impact] Unauthenticated remote attackers can exploit the ProxyServlet to access internal network resources, or chain it with other vulnerabilities (such as XXE) to steal admin credentials and achieve Remote Code Execution (RCE).

[Mitigation] Immediately apply the official security patches corresponding to your Zimbra version and restrict external access to the ProxyServlet endpoint.

[Affected Scope] Zimbra Collaboration Suite (ZCS) versions prior to 8.7 Patch 1 and 8.8.x versions prior to 8.8.7

[Impact] Remote attackers can execute arbitrary web script or HTML in the victim's browser context via a manipulated Content-Location header in an email attachment, leading to session hijacking and account takeover

[Mitigation] Immediately upgrade Zimbra Collaboration Suite to the latest patched version (8.7 Patch 1, 8.8.7, or later)