PT-2022-27681 · Zimbra · Zimbra Collaboration

Threonic · Published 2022-12-05 · Updated 2022-12-08 · CVE-2022-45912

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions 8.8.15 through 9.0

Description An issue was discovered in Zimbra Collaboration, allowing remote code execution through the ClientUploader utility by an authenticated admin user. The admin user can upload files and traverse to any other directory for remote code execution.

Recommendations For versions 8.8.15 and 9.0, consider disabling the ClientUploader utility until a patch is available to prevent remote code execution. Restrict access to the ClientUploader utility to minimize the risk of exploitation. Avoid using the ClientUploader utility for file uploads until the issue is resolved.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-45912

Affected Products

Zimbra Collaboration

References · 5

• https://osv.dev/vulnerability/CVE-2022-45912 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45912 · Security Note
• https://gist.github.com/Threonic/e90c85e11e1ac925ff57783988779e76 · Note
• https://t.me/cibsecurity/54040 · Telegram Post
• https://t.me/cvenotify/39191 · Telegram Post