Synacor · Zimbra Collaboration Suite (ZCS)
CVE-2019-9621
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Nedir
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
CISA: Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery (SSRF) vulnerability via the ProxyServlet component.
Ne yapmalı
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
ABD federal kurumları için son tarih: 28 Temmuz 2025
- CISA listesine eklenme
- 7 Temmuz 2025
- Yayımlanma
- 30 Nisan 2019
- Önem
- Yüksek 7,5 CVSS 3.1
- Önümüzdeki 30 günde saldırı olasılığı (EPSS)
- 81% bilinen tüm açıkların en üstteki 0,4% diliminde
- Zayıflık
- CWE-918 CWE-807
- Daha fazla ayrıntı
- NVD · CVE.org · CISA
Tüm kaynaklar (9)
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://wiki.zimbra.com/wiki/Security_Center
- https://bugzilla.zimbra.com/show_bug.cgi?id=109127
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.h…
- https://www.exploit-db.com/exploits/46693/
- https://blog.zimbra.com/2019/03/9826/
- https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html
- http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html
Synacor için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 21 Ağu 2026 | OS Command Injection | Zimbra Collaboration Suite (ZCS) | Yüksek 8,9 | 72% |
| 20 Nis 2026 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Orta 6,1 | 1,7% |
| 18 Mar 2026 | Cross-Site Scripting | Zimbra Collaboration Suite (ZCS) | Yüksek 7,2 | 20% |
| 7 Eki 2025 | Cross-site Scripting | Zimbra Collaboration Suite (ZCS) | Orta 5,4 | 4,1% |
| 19 May 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Orta 6,1 | 25% |
| 25 Şub 2025 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Kritik 9,0 | 77% |
| 3 Eki 2024 | Command Execution | Zimbra Collaboration Suite (ZCS) | Kritik 10,0 | 99,9% |
| 27 Tem 2023 | Cross-Site Scripting (XSS) | Zimbra Collaboration Suite (ZCS) | Orta 6,1 | 49% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.