CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 1CVE-2022-41347
https://notcve.org/view.php?id=CVE-2022-41347
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root. Se ha detectado un problema en Zimbra Collaboration (ZCS) versiones 8.8.x y 9.x (por ejemplo, 8.8.15). La configuración Sudo permite al usuario zimbra ejecutar el binario NGINX como root con parámetros arbitrarios. • https://darrenmartyn.ie/2021/10/25/zimbra-nginx-local-root-exploit https://github.com/darrenmartyn/zimbra-hinginx https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories •
CVSS: 9.8EPSS: 94%CPEs: 2EXPL: 2CVE-2022-41352 – Zimbra Collaboration (ZCS) Arbitrary File Upload Vulnerability
https://notcve.org/view.php?id=CVE-2022-41352
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio. • https://github.com/rxerium/CVE-2022-41352 http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html https://forums.zimbra.org/viewtopic.php?t=71153&p=306532 https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild https://blog.zimbra.com/2022/09/security-update-make-sure-to-install-pax-spax https://www.openwall.com/list • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-37044
https://notcve.org/view.php?id=CVE-2022-37044
In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine. En Zimbra Collaboration Suite (ZCS) versión 8.8.15, la URL en /h/search?action acepta parámetros llamados extra, title y onload que están parcialmente saneados y conllevan a un ataque de tipo XSS reflejado que permite ejecutar JavaScript arbitrario en la máquina de la víctima. • https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.7EPSS: 0%CPEs: 2EXPL: 0CVE-2022-37043
https://notcve.org/view.php?id=CVE-2022-37043
An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views an attacker-controlled page, a request will be sent to the application that appears to be intended. The CSRF token is omitted from the request, but the request still succeeds. Se ha descubierto un problema en el componente webmail de Zimbra Collaboration Suite (ZCS) versiones 8.8.15 y 9.0. • https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 97%CPEs: 2EXPL: 3CVE-2022-37042 – Zimbra Collaboration (ZCS) Authentication Bypass Vulnerability
https://notcve.org/view.php?id=CVE-2022-37042
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925. Zimbra Collaboration Suite (ZCS) versiones 8.8.15 y 9.0, presenta una funcionalidad mboximport que recibe un archivo ZIP y extrae archivos de él. Al omitir la autenticación (es decir, al no tener un authtoken), un atacante puede cargar archivos arbitrarios en el sistema, conllevando a un salto de directorios y una ejecución de código remota. • https://github.com/aels/CVE-2022-37042 https://github.com/0xf4n9x/CVE-2022-37042 http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html https://wiki.zimbra.com/wiki/Security_Center https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •