CVE-2019-9621
Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
4
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
Zimbra Collaboration Suite anterior de la versión 8.6 path 13, versión 8.7.x anterior de la 8.7.11 path 10, y versión 8.8.x anterior de la 8.8.10 path 7 u versión 8.8.x anterior de la 8.8.11 path 3, permite vulnerabilidad de tipo SSRF por medio del componente ProxyServlet.
Zimbra versions prior to 8.8.1 suffer from XML external entity injection and server-side request forgery vulnerabilities.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-03-06 CVE Reserved
- 2019-04-11 CVE Published
- 2019-06-05 First Exploit
- 2024-08-04 CVE Updated
- 2024-09-20 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html | X_refsource_misc |
|
| https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html | Third Party Advisory | |
| https://bugzilla.zimbra.com/show_bug.cgi?id=109127 | X_refsource_misc |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://blog.zimbra.com/2019/03/9826 | 2019-06-06 | |
| https://wiki.zimbra.com/wiki/Security_Center | 2019-06-06 | |
| https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories | 2019-06-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | < 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version " < 8.6.0" | - |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | >= 8.7.0 < 8.7.11 Search vendor "Zimbra" for product "Collaboration Server" and version " >= 8.7.0 < 8.7.11" | - |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | >= 8.8.0 < 8.8.10 Search vendor "Zimbra" for product "Collaboration Server" and version " >= 8.8.0 < 8.8.10" | - |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | - |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p1 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p10 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p11 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p12 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p2 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p3 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p4 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p5 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p6 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p7 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p8 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.6.0 Search vendor "Zimbra" for product "Collaboration Server" and version "8.6.0" | p9 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.7.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.7.11" | - |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.7.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.7.11" | p1 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.7.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.7.11" | p2 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.7.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.7.11" | p3 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.7.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.7.11" | p4 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.7.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.7.11" | p5 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.7.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.7.11" | p6 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.7.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.7.11" | p7 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.7.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.7.11" | p8 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.7.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.7.11" | p9 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.8.10 Search vendor "Zimbra" for product "Collaboration Server" and version "8.8.10" | - |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.8.10 Search vendor "Zimbra" for product "Collaboration Server" and version "8.8.10" | p1 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.8.10 Search vendor "Zimbra" for product "Collaboration Server" and version "8.8.10" | p2 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.8.10 Search vendor "Zimbra" for product "Collaboration Server" and version "8.8.10" | p3 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.8.10 Search vendor "Zimbra" for product "Collaboration Server" and version "8.8.10" | p4 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.8.10 Search vendor "Zimbra" for product "Collaboration Server" and version "8.8.10" | p5 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.8.10 Search vendor "Zimbra" for product "Collaboration Server" and version "8.8.10" | p6 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.8.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.8.11" | - |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.8.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.8.11" | p1 |
Affected
| ||||||
| Zimbra Search vendor "Zimbra" | Collaboration Server Search vendor "Zimbra" for product "Collaboration Server" | 8.8.11 Search vendor "Zimbra" for product "Collaboration Server" and version "8.8.11" | p2 |
Affected
| ||||||