- Description
- Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
- Source
- cve@mitre.org
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 7.2
- Impact score
- 5.9
- Exploitability score
- 1.2
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
CVSS 2.0
- Type
- Primary
- Base score
- 6.5
- Impact score
- 6.4
- Exploitability score
- 8
- Vector string
- AV:N/AC:L/Au:S/C:P/I:P/A:P
Data from CISA
- Vulnerability name
- Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
- Exploit added on
- Aug 11, 2022
- Exploit action due
- Sep 1, 2022
- Required action
- Apply updates per vendor instructions.
- Hype score
- Not currently trending
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9E39A855-C0EB-4448-AE96-177757C40C66"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "32AFCE22-5ADA-4FF7-A165-5EC12B325DEF"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D3577FE6-F1F4-4555-8D27-84D6DE731EA3"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "931BD98E-1A5F-4634-945B-BDD7D2FAA8B0"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2E7C0A57-A887-4D29-B601-4275313F46B3"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B7248B91-D136-4DD5-A631-737E4C220A02"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "494F6FD4-36ED-4E40-8336-7F077FA80FA8"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9DF8C0CE-A71D-4BB1-83FB-1EA5ED77E0C9"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E0648498-2EE5-4B68-8360-ED5914285356"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24282FF8-548B-415B-95CA-1EFD404D21D3"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ACFDF2D9-ED72-4969-AA3B-E8D48CB1922D"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B7D0A8B-7A72-4C1A-85F2-BE336CA47E0B"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "019AFC34-289E-4A01-B08B-A5807F7F909A"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E7B3976-DA6F-4285-93E6-2328006F7F4D"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "062E586F-0E02-45A6-93AD-895048FC2D4C"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3EE37BEE-4BDB-4E62-8DE3-98CF74DFBE01"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "ADF51BCA-37DD-4642-B201-74A6D1A545FF"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "39611F3D-A898-4C35-8915-3334CDFB78E5"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FA310AFA-492D-4A6C-A7F6-740E82CB6E57"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2AF337B5-B296-449B-8848-7636EC7C46C5"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "52232ACA-C158-48C8-A0DB-7689040CB8FB"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3B4D0040-86D0-46C3-8A9A-3DD12138B9ED"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2BB9BC7-078D-4E08-88E4-9432D74CA9BA"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F04D4B77-D386-4BC8-8169-9846693F6F11"
},
{
"criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "992370FA-F171-4FB3-9C1C-58AC37038CE4"
}
],
"operator": "OR"
}
]
}
]