PT-2024-8885 · Zimbra · Zimbra Collaboration

Published

2024-04-22

·

Updated

2024-08-16

·

CVE-2024-33535

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration (ZCS) versions 9.0 through 10.0
Description: The issue involves unauthenticated local file inclusion (LFI) in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without authentication, potentially leading to unauthorized access to sensitive information. The vulnerability is limited to files within a specific directory.
Recommendations: For Zimbra Collaboration (ZCS) versions 9.0 through 10.0, consider disabling the handling of the packages parameter in the web application as a temporary workaround until a patch is available. Restrict access to sensitive files within the specific directory to minimize the risk of exploitation.

Fix

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2024-10552
CVE-2024-33535

Affected Products

Zimbra Collaboration