PT-2024-6227 · Zimbra · Zimbra Collaboration

Lebr0Nli

·

Published

2024-09-04

·

Updated

2024-10-30

·

CVE-2024-45518

CVSS v3.1

8.8

High

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Zimbra Collaboration (ZCS) versions 10.1.x through 10.1.0 Zimbra Collaboration (ZCS) versions 10.0.x through 10.0.8 Zimbra Collaboration (ZCS) 9.0.0 before Patch 41 Zimbra Collaboration (ZCS) 8.8.15 before Patch 46
Description An issue in Zimbra Collaboration allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This permits unauthorized HTTP requests to be sent to internal services, potentially leading to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE).
Recommendations For Zimbra Collaboration (ZCS) versions 10.1.x through 10.1.0, update to version 10.1.1 or later. For Zimbra Collaboration (ZCS) versions 10.0.x through 10.0.8, update to version 10.0.9 or later. For Zimbra Collaboration (ZCS) 9.0.0, apply Patch 41 or later. For Zimbra Collaboration (ZCS) 8.8.15, apply Patch 46 or later.

Fix

RCE

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2024-07171
CVE-2024-45518

Affected Products

Zimbra Collaboration