PT-2022-3567 · Zimbra · Zimbra Collaboration

Simon Scannell · Published 2022-04-20 · Updated 2026-01-06 · CVE-2022-27924

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (aka ZCS) versions 8.8.15 through 9.0.0

Description The issue allows an unauthenticated attacker to inject arbitrary memcache commands into a targeted instance, causing an overwrite of arbitrary cached entries. This can be exploited to execute arbitrary commands and potentially steal user credentials. The vulnerability is being actively exploited.

Recommendations For Zimbra Collaboration (aka ZCS) versions 8.8.15 through 9.0.0, update to version 8.8.15 P31.1 or 9.0.0 P24.1 to resolve the issue. As a temporary workaround, consider restricting access to memcache commands to minimize the risk of exploitation.

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

BDU:2022-04351

CVE-2022-27924

Affected Products

Zimbra Collaboration

References · 23

• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24.1#Security_Fixes · Security Note
• https://bdu.fstec.ru/vul/2022-04351 · Security Note
• https://osv.dev/vulnerability/CVE-2022-27924 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27924 · Security Note
• https://twitter.com/rst_cloud/status/1846985646482588095 · Twitter Post
• https://t.me/cvenotify/112369 · Telegram Post
• https://twitter.com/transilienceai/status/1848896487125668279 · Twitter Post
• https://twitter.com/Imperva/status/1846194336205086955 · Twitter Post
• https://t.me/aptreports/13534 · Telegram Post
• https://t.me/aptreports/13368 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27924 · Note
• https://t.me/cveNotify/141181 · Telegram Post