PT-2019-6062 · Zimbra · Zimbra Collaboration Suite

An Trinh + 1 · Published 2019-05-29 · Updated 2025-11-04 · CVE-2019-9670

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions 8.7.x through 8.7.11p9

Description The issue is related to an XML External Entity injection (XXE) vulnerability in the mailboxd component of the Zimbra Collaboration Suite, specifically affecting the Autodiscover/Autodiscover.xml endpoint. This vulnerability can be exploited by a remote attacker to perform an XXE attack. The vulnerability is due to improper restriction of XML external entity references.

Recommendations For Zimbra Collaboration Suite versions 8.7.x through 8.7.11p9, update to version 8.7.11p10 or later to resolve the issue. As a temporary workaround, consider restricting access to the Autodiscover/Autodiscover.xml endpoint until a patch is applied.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2021-04391

CVE-2019-9670

Affected Products

Zimbra Collaboration Suite

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/linux/http/zimbra_xxe_rce.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb · Exploit
• 🔥 https://github.com/rek7/Zimbra-RCE · Exploit
• 🔥 https://github.com/oppsec/zaber · Exploit
• 🔥 https://github.com/oppsec/arbimz · Exploit
• 🔥 https://exploit-db.com/exploits/46693 · Exploit
• 🔥 https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570 · Exploit
• 🔥 http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-9670 · Security Note
• https://bugzilla.zimbra.com/show_bug.cgi?id=109129 · Patch
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04391 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9670 · Vendor Advisory
• https://t.me/cvenotify/87299 · Telegram Post
• https://t.me/poxek/2761 · Telegram Post