This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Zimbra Collaboration fixes 2 vulnerabilities

Zimbra versions 9.0.0 Patch 43, 10.0.12 and 10.1.4 fix 2 vulnerabilities in the Zimbra Collaboration product [1][2].

Zimbra Collaboration - SQL injection (CVE-2025-25064)
CVSS 9.8 (Critical)

Allows an unauthenticated remote attacker, through insufficient sanitization of a user-supplied parameter in the SOAP endpoint of the ZimbraSync Service, to manipulate this parameter in order to inject arbitrary SQL queries, which may lead to the retrieval of e-mail metadata [1].

The vulnerability is present in product:

  • *:Zimbra Collaboration; >=10.0.0, <10.0.12; >=10.1.0, <10.1.4

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-25064 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 3. 2. 2025.

Zimbra Collaboration - server-side request forgery (CVE-2025-25065)
CVSS 5.3 (Medium)

Allows an unauthenticated remote attacker, through a vulnerability in the RSS feed parser, to perform unauthorized redirection to internal network endpoints [2].

The vulnerability is present in product:

  • *:Zimbra Collaboration; =9.0.0 before Patch 43; >=10.0.0, <10.0.12; >=10.1.0, <10.1.4

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

More information:

The vulnerability was publicly disclosed 3. 2. 2025.

By CESNET, z.s.p.o. Michaela Jarošová on 10. 2. 2025.

CESNET, z.s.p.o. Logo