Synacor · Zimbra Collaboration Suite (ZCS)
CVE-2024-45519
Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
What it is
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
CISA: Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: October 24, 2024
- Added to the CISA list
- October 3, 2024
- Published
- October 2, 2024
- Severity
- Critical 10.0 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-284
- More details
- NVD · CVE.org · CISA
All references (6)
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
More exploited flaws from Synacor
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 21, 2026 | OS Command Injection | Zimbra Collaboration Suite (ZCS) | High 8.9 | 72% |
| Apr 20, 2026 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 1.7% |
| Mar 18, 2026 | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | High 7.2 | 20% |
| Oct 7, 2025 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Medium 5.4 | 4.1% |
| Jul 7, 2025 | Server-Side Request Forgery (SSRF) | Zimbra Collaboration Suite (ZCS) | High 7.5 | 81% |
| May 19, 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 25% |
| Feb 25, 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Critical 9.0 | 77% |
| Jul 27, 2023 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Medium 6.1 | 49% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.