Veille CVE
CVE-2019-9621
7.5 Élevée Exploitée activementCatalogue CISA KEV — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Ajoutée le 07/07/2025 · Échéance de correction (agences US) : 28/07/2025
Action requise : Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.5 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 3.1 | 7.5 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | 5.0 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Faiblesses (CWE)
Références
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html ExploitThird Party AdvisoryVDB Entry
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce ExploitThird Party Advisory
- https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html Third Party Advisory
- https://blog.zimbra.com/2019/03/9826/ Vendor Advisory
- https://bugzilla.zimbra.com/show_bug.cgi?id=109127 Issue Tracking
- https://wiki.zimbra.com/wiki/Security_Center Release NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://www.exploit-db.com/exploits/46693/ ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html ExploitThird Party AdvisoryVDB Entry
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce ExploitThird Party Advisory
- https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html Third Party Advisory
- https://blog.zimbra.com/2019/03/9826/ Vendor Advisory
- https://bugzilla.zimbra.com/show_bug.cgi?id=109127 Issue Tracking
- https://wiki.zimbra.com/wiki/Security_Center Release NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://www.exploit-db.com/exploits/46693/ ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9621 US Government Resource