Veille CVE
CVE-2022-27925
7.2 Élevée Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Ajoutée le 11/08/2022 · Échéance de correction (agences US) : 01/09/2022
Action requise : Apply updates per vendor instructions.
Description
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.2 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 7.2 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 6.5 Moyenne | nvd@nist.gov (NVD) | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Faiblesses (CWE)
Références
- http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html ExploitThird Party AdvisoryVDB Entry
- https://wiki.zimbra.com/wiki/Security_Center Vendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24 Release NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html ExploitThird Party AdvisoryVDB Entry
- https://wiki.zimbra.com/wiki/Security_Center Vendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24 Release NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27925 US Government Resource