CISA Known Exploited Vulnerability (KEV)
Synacor Zimbra Collaboration Command Execution Vulnerability
October 3, 2024
October 24, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
References
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
Weakness Enumeration
| CWE-ID | CWE Name |
|---|---|
|
CWE-284 |
Improper Access Control |