Synacor · Zimbra Collaboration Suite (ZCS)
CVE-2024-45519
Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
O que é
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
CISA: Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.
O que fazer
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Prazo para as agências federais dos EUA: 24 de outubro de 2024
- Adicionada à lista da CISA
- 3 de outubro de 2024
- Publicada
- 2 de outubro de 2024
- Gravidade
- Crítica 10,0 CVSS 3.1
- Chance de ataques nos próximos 30 dias (EPSS)
- 99,9% entre os 0,1% mais altos de todas as vulnerabilidades conhecidas
- Fraqueza
- CWE-284
- Mais detalhes
- NVD · CVE.org · CISA
Todas as referências (6)
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
Mais falhas exploradas de Synacor
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 21 de ago. de 2026 | OS Command Injection | Zimbra Collaboration Suite (ZCS) | Alto 8,9 | 72% |
| 20 de abr. de 2026 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Média 6,1 | 1,7% |
| 18 de mar. de 2026 | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | Alto 7,2 | 20% |
| 7 de out. de 2025 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Média 5,4 | 4,1% |
| 7 de jul. de 2025 | Server-Side Request Forgery (SSRF) | Zimbra Collaboration Suite (ZCS) | Alto 7,5 | 81% |
| 19 de mai. de 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Média 6,1 | 25% |
| 25 de fev. de 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Crítica 9,0 | 77% |
| 27 de jul. de 2023 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Média 6,1 | 49% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.