CyberSec.Space Logo
CVEブラウザに戻る

CVE-2018-20160

CRITICAL
9.8
CVSS Severity Score
EPSS Score0.0430%
EPSS Percentile1.77th
Published2019年5月29日
Last Modified2024年11月21日

Vulnerability Description

ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other products, allows XXE attacks, as demonstrated by a crafted XML request to mailboxd.

Affected Platforms (CPE)

📦
Synacor

Zimbra Collaboration Suite

>= 8.7.0 and < 8.7.11
📦
Synacor

Zimbra Collaboration Suite

>= 8.8.0 and < 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.9
📦
Synacor

Zimbra Collaboration Suite

= 8.8.10
📦
Synacor

Zimbra Collaboration Suite

= 8.8.10
📦
Synacor

Zimbra Collaboration Suite

= 8.8.10
📦
Synacor

Zimbra Collaboration Suite

= 8.8.10
📦
Synacor

Zimbra Collaboration Suite

= 8.8.11

References & Advisories

🔗 https://bugzilla.zimbra.com/show_bug.cgi?id=109093
🔗 https://wiki.zimbra.com/wiki/Security_Center
🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
🔗 https://bugzilla.zimbra.com/show_bug.cgi?id=109093
🔗 https://wiki.zimbra.com/wiki/Security_Center
🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

関連する脆弱性情報

CVE-2020-77969.8

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

CVE-2019-96709.8

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnera...

CVE-2019-69809.8

Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.

CVE-2021-352099.8

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9....