This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Zimbra Collaboration fixes 1 vulnerability

Zimbra fixes 1 vulnerability in Zimbra Collaboration in versions 9.0.0 Patch 41, 10.0.9, 10.1.1 and 8.8.15 Patch 46 [1].

Zimbra Collaboration - command injection (CVE-2024-45519)
CVSS 10.0 (Critical)

An unauthenticated remote attacker can, under certain circumstances, execute commands in the operating system of the affected machine by sending a specially crafted e-mail [2] [3]. To exploit the vulnerability, the "postjournal" service (which is disabled in the default configuration) must be enabled, and the attacker must either be authenticated or have an IP address within the range <Public IP>/20, where "Public IP" is the public IP address of the affected machine [2]. Details and a PoC for the vulnerability can be found at [2].

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

  • CVE-2024-45519 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 27. 9. 2024.

By CESNET, z.s.p.o. Martin Krajči on 3. 10. 2024.

CESNET, z.s.p.o. Logo