CyberSec.Space Logo
Back to CVE Browser

CVE-2019-9621

Known Exploited (CISA KEV)HIGH
7.5
CVSS Severity Score
EPSS Score78.8730%
EPSS Percentile86.67th
PublishedApr 30, 2019
Last ModifiedNov 4, 2025

Vulnerability Description

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

Affected Platforms (CPE)

📦
Synacor

Zimbra Collaboration Suite

< 8.6.0
📦
Synacor

Zimbra Collaboration Suite

>= 8.7.0 and < 8.7.11
📦
Synacor

Zimbra Collaboration Suite

>= 8.8.0 and < 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.6.0
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.10
📦
Synacor

Zimbra Collaboration Suite

= 8.8.10
📦
Synacor

Zimbra Collaboration Suite

= 8.8.10
📦
Synacor

Zimbra Collaboration Suite

= 8.8.10
📦
Synacor

Zimbra Collaboration Suite

= 8.8.10
📦
Synacor

Zimbra Collaboration Suite

= 8.8.10
📦
Synacor

Zimbra Collaboration Suite

= 8.8.10
📦
Synacor

Zimbra Collaboration Suite

= 8.8.11
📦
Synacor

Zimbra Collaboration Suite

= 8.8.11
📦
Synacor

Zimbra Collaboration Suite

= 8.8.11
📦
Synacor

Zimbra Collaboration Suite

= 8.8.11

References & Advisories

🔗 http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
🔗 http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html
🔗 http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
🔗 https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html
🔗 https://blog.zimbra.com/2019/03/9826/
🔗 https://bugzilla.zimbra.com/show_bug.cgi?id=109127
🔗 https://wiki.zimbra.com/wiki/Security_Center
🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Related Vulnerabilities

CVE-2019-96709.8

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnera...

CVE-2018-201609.8

ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other ...

CVE-2019-69809.8

Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.

CVE-2020-77969.8

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.