CISA Known Exploited Vulnerability (KEV)
Synacor Zimbra Collaboration Command Execution Vulnerability
October 3, 2024
October 24, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
References
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
- https://blog.projectdiscovery.io/zimbra-remote-code-execution/
Weakness Enumeration
| CWE-ID | CWE Name |
|---|---|
|
CWE-78 |
Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) |