Login Request a demo
Critical severity · published Aug 11, 2022
CVE-2022-37042
Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
RansomwareIn wildKEV
9.8
CVSS
91.9%
EPSS
Yes
On KEV
Description
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)91.9% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Aug 11, 2022
Federal remediation dueSep 1, 2022
Ransomware campaign useKnown
Affected products
Which versions
ZC
Zimbra Collaboration Suite · Synacor
8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; 8.8.15; +34 more · source: NVD
ZC
Zimbra Collaboration Suite (ZCS) · Synacor
All versions, or not specified · source: KEV
Affected product
ZC
Zimbra Collaboration Suite
Synacor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-37042
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-37042
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
x_refsource_MISC
https://wiki.zimbra.com/wiki/Security_Center
x_refsource_MISC
http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html
More from Zimbra Collaboration Suite
9.8
CVE-2024-45519
Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
9.8
CVE-2022-41352
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
9.8
CVE-2020-7796
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability
9.8
CVE-2019-9670
Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
9.0
CVE-2023-34192
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability