PT-2020-13291 · Zimbra · Zimbra

Published 2020-06-03 · Updated 2020-06-05 · CVE-2020-12846

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zimbra versions prior to 8.8.15 Patch 10 Zimbra versions 9.x prior to 9.0.0 Patch 3

Description The issue allows remote code execution via an avatar file, potentially abusing the /service/upload servlet in the webmail subsystem. A user can upload executable files, such as exe, sh, bat, or jar, in the Contact section of the mailbox as an avatar image for a contact. Although the user receives a "Corrupt File" error, the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.

Recommendations For Zimbra versions prior to 8.8.15 Patch 10, update to version 8.8.15 Patch 10 or later. For Zimbra versions 9.x prior to 9.0.0 Patch 3, update to version 9.0.0 Patch 3 or later. As a temporary workaround, consider restricting access to the /service/upload servlet to minimize the risk of exploitation.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-12846

Affected Products

Zimbra

References · 5

• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12846 · Security Note
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12846 · Vendor Advisory