PT-2023-26582 · Zimbra · Zimbra Collaboration

CVE-2023-38750 · Publicado 2023-07-28 · Atualizado 2023-09-09

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions 8.0.0 through 8.8.15 Patch 40 Zimbra Collaboration (ZCS) versions 9.0.0 through 9.0.0 Patch 33 Zimbra Collaboration (ZCS) versions 10.0.0 through 10.0.1

Description Internal JSP and XML files can be exposed in Zimbra Collaboration. This issue has been reported as actively exploited.

Recommendations For Zimbra Collaboration (ZCS) version 8, update to 8.8.15 Patch 41 or later. For Zimbra Collaboration (ZCS) version 9, update to 9.0.0 Patch 34 or later. For Zimbra Collaboration (ZCS) version 10, update to 10.0.2 or later.

Exploit

Correção

Identificadores relacionados

CVE-2023-38750

Produtos afetados

Zimbra Collaboration

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/38xxx/CVE-2023-38750.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-38750 · Aviso do Fabricante
• https://twitter.com/og_n0tail/status/1700688073213002213 · Publicação no Twitter
• https://wiki.zimbra.com/wiki/Security_Center · Aviso do Fabricante
• https://t.me/cvenotify/55588 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-38750 · Nota de Segurança
• https://t.me/cibsecurity/67485 · Publicação no Telegram
• https://t.me/true_secator/4670 · Publicação no Telegram
• https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy · Nota
• https://t.me/pentestingnews/38072 · Publicação no Telegram