PT-2019-6447 · Zimbra · Zimbra Collaboration Suite

An Trinh + 1 · Published 2019-03-13 · Updated 2025-11-04 · CVE-2019-9621

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 8.6 patch 13 Zimbra Collaboration Suite versions 8.7.x prior to 8.7.11 patch 10 Zimbra Collaboration Suite versions 8.8.x prior to 8.8.10 patch 7 Zimbra Collaboration Suite versions 8.8.x prior to 8.8.11 patch 3

Description The issue resides in insufficient input validation within Zimbra Collaboration Suite. Exploitation of this issue may allow a remote attacker to perform a Server-Side Request Forgery (SSRF) attack via the ProxyServlet component. SSRF occurs when an attacker can cause the server to make requests to unintended locations.

Recommendations Zimbra Collaboration Suite versions prior to 8.6 patch 13 should be updated to version 8.6 patch 13 or later. Zimbra Collaboration Suite versions 8.7.x prior to 8.7.11 patch 10 should be updated to version 8.7.11 patch 10 or later. Zimbra Collaboration Suite versions 8.8.x prior to 8.8.10 patch 7 should be updated to version 8.8.10 patch 7 or later. Zimbra Collaboration Suite versions 8.8.x prior to 8.8.11 patch 3 should be updated to version 8.8.11 patch 3 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2024-08043

CVE-2019-9621

Affected Products

Zimbra Collaboration Suite

References · 26

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb · Exploit
• 🔥 https://github.com/k8gege/ZimbraExploit · Exploit
• 🔥 https://exploit-db.com/exploits/46967 · Exploit
• 🔥 http://rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce · Exploit
• 🔥 http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html · Exploit
• 🔥 https://exploit-db.com/exploits/46693 · Exploit
• 🔥 http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html · Exploit
• 🔥 https://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html · Exploit
• https://blog.zimbra.com/2019/03/9826 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9621 · Security Note
• https://bdu.fstec.ru/vul/2024-08043 · Security Note
• https://osv.dev/vulnerability/CVE-2019-9621 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9621 · Note
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Security Note, Vendor Advisory
• https://t.me/echeloneyes/3956 · Telegram Post