Служба постжурнала в Zimbra Collaboration (ZCS) до версий 8.8.15, патчей 46, 9 до 9.0.0, патчей 41, 10 до 10.0.9 и 10.1 до 10.1.1 иногда позволяет неаутентифицированным пользователям выполнять команды.
Показать оригинальное описание (EN)
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
Характеристики атаки
Способ атаки
По сети
Атака возможна удалённо
Сложность
Низкая
Легко эксплуатировать
Нужны права
Не требуются
Права не нужны
Участие пользователя
Не требуется
Не нужно действие пользователя
Последствия
Конфиденциальность
Высокое
Полная утечка данных
Целостность
Высокое
Полная модификация данных
Доступность
Высокое
Полный отказ в обслуживании
Строка CVSS v3.1
Тип уязвимости (CWE)
Уязвимые продукты 92
| Конфигурация | От (включительно) | До (исключительно) |
|---|---|---|
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
|
— |
8.8.15
|
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
|
10.0.0
|
10.0.9
|
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p33:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p34:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p35:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p36:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p37:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p38:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p39:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p40:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p41:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p42:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p43:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p44:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p45:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p26:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p27:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p28:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p29:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p30:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p31:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p32:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p33:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p34:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p35:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p36:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p37:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p38:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p39:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p40:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*
|
— | — |
|
Synacor Zimbra_Collaboration_Suite
cpe:2.3:a:synacor:zimbra_collaboration_suite:10.1.0:*:*:*:*:*:*:*
|
— | — |
Ссылки 8
https://wiki.zimbra.com/wiki/Security_Center
cve@mitre.org
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes
cve@mitre.org
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
cve@mitre.org
https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
cve@mitre.org
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes
cve@mitre.org
https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
cve@mitre.org
https://blog.projectdiscovery.io/zimbra-remote-code-execution/
134c704f-9b21-4f2e-91b3-4a467353bcc0
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024…
134c704f-9b21-4f2e-91b3-4a467353bcc0