CVE-2020-12846
Published Jun 3, 2020
Last updated 4 years ago
Overview
- Description
- Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.
- Source
- cve@mitre.org
- NVD status
- Analyzed
Risk scores
CVSS 3.1
- Type
- Primary
- Base score
- 8
- Impact score
- 5.9
- Exploitability score
- 2.1
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 6
- Impact score
- 6.4
- Exploitability score
- 6.8
- Vector string
- AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
- nvd@nist.gov
- CWE-434
Social media
- Hype score
- Not currently trending
Configurations
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E8BF8662-919E-4A40-917F-FEA0EA73491C",
"versionEndExcluding": "8.8.15"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E39A855-C0EB-4448-AE96-177757C40C66"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FFE7BE6E-7A9A-40C7-B236-7A21103E9F41"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6FCB5528-70FD-4525-A78B-D5537609331A"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EF2EE32D-04A5-46EA-92F0-3C8D74A4B82A"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BB3C28CA-4C22-423E-B1C7-CBAFBB91F4DB"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A9A1314A-20C8-42D7-9387-D914999EEAF6"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CEF091C5-8DC6-4A41-9E84-F53BE703F71B"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACD65C28-9716-4073-8613-C4AF12684760"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2C58AFFF-848F-490D-A95C-03A267C2DC98"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B62DC188-89A8-4AEA-90AE-563F0BBEFC54"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32AFCE22-5ADA-4FF7-A165-5EC12B325DEF"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D3577FE6-F1F4-4555-8D27-84D6DE731EA3"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E7B3976-DA6F-4285-93E6-2328006F7F4D"
}
],
"operator": "OR"
}
]
}
]