Veille CVE
CVE-2024-45519
9.8 Critique Exploitée activementCatalogue CISA KEV — Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
Ajoutée le 03/10/2024 · Échéance de correction (agences US) : 24/10/2024
Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 10.0 Critique | cve@mitre.org | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 3.1 | 9.8 Critique | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Faiblesses (CWE)
Références
- https://wiki.zimbra.com/wiki/Security_Center Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes Release Notes
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy Not Applicable
- https://blog.projectdiscovery.io/zimbra-remote-code-execution/ Exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45519 US Government Resource