BLACKOUT MAP

Synacor · Zimbra Collaboration Suite (ZCS)

CVE-2022-37042

Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

Explorada em ataques Usada por ransomware Crítica 9,8 Chance de ataque: 92%
Compartilhar

O que é

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

CISA: Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.

O que fazer

Apply updates per vendor instructions.

Prazo para as agências federais dos EUA: 1 de setembro de 2022

Adicionada à lista da CISA
11 de agosto de 2022
Publicada
11 de agosto de 2022
Gravidade
Crítica 9,8 CVSS 3.1
Chance de ataques nos próximos 30 dias (EPSS)
92% entre os 0,2% mais altos de todas as vulnerabilidades conhecidas
Fraqueza
CWE-23
Mais detalhes
NVD · CVE.org · CISA
Todas as referências (3)

Mais falhas exploradas de Synacor

AdicionadoVulnerabilidadeProdutoGravidadeChance de ataque
21 de ago. de 2026OS Command InjectionCVE-2026-73570Zimbra Collaboration Suite (ZCS)Alto 8,972%
20 de abr. de 2026Cross-site ScriptingCVE-2025-48700Zimbra Collaboration Suite (ZCS)Média 6,11,7%
18 de mar. de 2026Cross-Site ScriptingCVE-2025-66376Zimbra Collaboration Suite (ZCS)Alto 7,220%
7 de out. de 2025Cross-site ScriptingCVE-2025-27915Zimbra Collaboration Suite (ZCS)Média 5,44,1%
7 de jul. de 2025Server-Side Request Forgery (SSRF)CVE-2019-9621Zimbra Collaboration Suite (ZCS)Alto 7,581%
19 de mai. de 2025Cross-Site Scripting (XSS)CVE-2024-27443Zimbra Collaboration Suite (ZCS)Média 6,125%
25 de fev. de 2025Cross-Site Scripting (XSS)CVE-2023-34192Zimbra Collaboration Suite (ZCS)Crítica 9,077%
3 de out. de 2024Command ExecutionCVE-2024-45519Zimbra Collaboration Suite (ZCS)Crítica 10,099,9%

Todas →

Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.