This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Zimbra Collaboration fixes a high-severity vulnerability

Zimbra fixes another vulnerability in Zimbra Collaboration with versions 9.0.0 Patch 41, 10.0.9, 10.1.1 and 8.8.15 Patch 46 [1].

Zimbra Collaboration - remote code execution (CVE-2024-45518)
CVSS 8.8 (High)

An authenticated remote attacker is able to exploit a Server-Side Request Forgery (SSRF) vulnerability due to insufficient input handling and an incorrectly configured domain whitelist, which allows the attacker to send unauthorized HTTP requests to internal services. In this way, remote code execution may occur by chaining Command Injection within an internal service. In combination with existing XSS vulnerabilities, SSRF may facilitate remote code execution [2].

The vulnerability is present in product:

  • Zimbra Collaboration; >=10.1.0, <10.1.1; 10.0.0, <10.0.9; >=9.0.0, 9.0.0 Patch 41; >=8.8.15, <8.8.15 Patch 46

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 22. 10. 2024.

By CESNET, z.s.p.o. Michaela Jarošová on 4. 11. 2024.

CESNET, z.s.p.o. Logo