Veille CVE
CVE-2022-41352
9.8 Critique Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Ajoutée le 20/10/2022 · Échéance de correction (agences US) : 10/11/2022
Action requise : Apply updates per vendor instructions.
Description
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html ExploitThird Party AdvisoryVDB Entry
- https://forums.zimbra.org/viewtopic.php?t=71153&p=306532 MitigationVendor Advisory
- https://wiki.zimbra.com/wiki/Security_Center PatchRelease NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/ Third Party Advisory
- http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html ExploitThird Party AdvisoryVDB Entry
- https://forums.zimbra.org/viewtopic.php?t=71153&p=306532 MitigationVendor Advisory
- https://wiki.zimbra.com/wiki/Security_Center PatchRelease NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41352 US Government Resource