CVE-2022-27925
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Why this priority
?
Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary
- Présent dans le catalogue CISA KEV (exploitation confirmée)
Description
Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Synacor | Zimbra Collaboration Suite (ZCS) | All versions |
| n/a | n/a |
|
Revision history
Revision 3
Revision 2
Update : Affected versions changed
Revision 1
New record
Qualification
- CVSS severity
?
Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary
- 7.2 HIGH CVSS v3.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- KEV catalog
?
CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary
- Listed
- Exploitation
- Confirmed
- EPSS probability
?
Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary
- Unknown
- Confidence
?
Quality of the sources behind the record. It is not a risk score. See the glossary
- High
Priority rules, version 1
CISA KEV catalog
- Added on
- 11 August 2022
- Federal due date
- 1 September 2022
- Required action
- Apply updates per vendor instructions.
- Ransomware use
- Known
Record
- Published on
- 21 April 2022
- Weaknesses (CWE)
- CWE-22
Sources
- Source : CISA Known Exploited Vulnerabilities Catalog Terms of use
- Source : CVE Program, cve.org Terms of use