PT-2022-4241 · Zimbra · Zimbra Collaboration Suite

Steven Adair + 1 · Published 2022-08-11 · Updated 2025-12-03 · CVE-2022-37042

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite (ZCS) versions 8.8.15 through 9.0

Description The mboximport functionality in Zimbra Collaboration Suite (ZCS) has an authentication bypass issue, allowing an attacker to upload arbitrary files to the system without an authtoken. This can lead to directory traversal and remote code execution. The issue is due to an incomplete fix for a previous vulnerability.

Recommendations For Zimbra Collaboration Suite (ZCS) versions 8.8.15 through 9.0, consider disabling the mboximport functionality until a patch is available to prevent exploitation. Restrict access to the mboximport module to minimize the risk of remote code execution. Avoid using the mboximport functionality in production environments until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Improper Authentication

Weakness Enumeration

CWE-22

CWE-287

Related Identifiers

BDU:2022-05091

CVE-2022-37042

Affected Products

Zimbra Collaboration Suite

References · 27

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_mboximport_cve_2022_27925.rb · Exploit
• 🔥 https://github.com/0xf4n9x/CVE-2022-37042 · Exploit
• 🔥 https://github.com/aels/CVE-2022-37042 · Exploit
• 🔥 https://github.com/GreyNoise-Intelligence/Zimbra_CVE-2022-37042-_CVE-2022-27925 · Exploit
• 🔥 http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html · Exploit
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05091 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37042 · Vendor Advisory
• https://wiki.zimbra.com/wiki/Security_Center · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37042 · Security Note
• https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability · Security Note
• https://t.me/echeloneyes/556 · Telegram Post
• https://t.me/freedomf0x/17153 · Telegram Post
• https://t.me/true_secator/3286 · Telegram Post
• https://t.me/aptreports/4765 · Telegram Post