PT-2017-10388 · Zimbra · Zimbra Collaboration Suite

Published 2017-03-29 · Updated 2020-06-04 · CVE-2016-9924

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite (ZCS) versions prior to 8.7.4

Description The issue allows remote attackers to conduct XML External Entity (XXE) attacks. This means that an attacker can potentially exploit the vulnerability to access sensitive data or disrupt the service.

Recommendations For versions prior to 8.7.4, update to version 8.7.4 or later to resolve the issue.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2016-9924

Affected Products

Zimbra Collaboration Suite

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9924 · Security Note
• https://osv.dev/vulnerability/CVE-2016-9924 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• http://securityfocus.com/bid/97121 · Note