PT-2021-7280 · Zimbra · Zimbra Collaboration

Mikhail Klyuchnikov · Published 2021-12-27 · Updated 2025-11-04 · CVE-2022-27925

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions 8.8.15 through 9.0

Description The issue concerns the mboximport functionality in Zimbra Collaboration, which allows an authenticated user with administrator rights to upload arbitrary files to the system, leading to directory traversal. This can be exploited by a remote attacker to upload arbitrary files. There are indicators showing that threat actors are using this issue to access user mailboxes and send scams.

Recommendations For Zimbra Collaboration versions 8.8.15 through 9.0, apply the available patch to fix the authenticated remote code execution issue. As a temporary workaround, consider restricting access to the mboximport functionality until the patch is applied. Restrict administrator rights to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Path traversal

Weakness Enumeration

CWE-434

CWE-22

Related Identifiers

BDU:2022-05086

CVE-2022-27925

Affected Products

Zimbra Collaboration

References · 49

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_mboximport_cve_2022_27925.rb · Exploit
• 🔥 https://github.com/vnhacker1337/CVE-2022-27925-PoC · Exploit
• 🔥 https://github.com/mohamedbenchikh/CVE-2022-27925 · Exploit
• 🔥 https://github.com/MeDx64/CVE-2022-27925 · Exploit
• 🔥 https://github.com/Josexv1/CVE-2022-27925 · Exploit
• 🔥 https://github.com/Inplex-sys/CVE-2022-27925 · Exploit
• 🔥 https://github.com/jam620/Zimbra · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2022-27925-Revshell · Exploit
• 🔥 http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html · Exploit
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05086 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27925 · Vendor Advisory
• https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability · Security Note