CyberSec.Space Logo
返回 CVE 浏览器

CVE-2019-9670

Known Exploited (CISA KEV)CRITICAL
9.8
CVSS Severity Score
EPSS Score82.2890%
EPSS Percentile95.58th
Published2019年5月29日
Last Modified2025年11月4日

Vulnerability Description

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

Affected Platforms (CPE)

📦
Synacor

Zimbra Collaboration Suite

>= 8.7.0 and < 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11
📦
Synacor

Zimbra Collaboration Suite

= 8.7.11

References & Advisories

🔗 http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
🔗 http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
🔗 https://bugzilla.zimbra.com/show_bug.cgi?id=109129
🔗 https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/
🔗 https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
🔗 https://www.exploit-db.com/exploits/46693/
🔗 http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
🔗 http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce

相关漏洞威胁

CVE-2020-77969.8

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

CVE-2018-201609.8

ZxChat (aka ZeXtras Chat), as used for zimbra-chat and zimbra-talk in Synacor Zimbra Collaboration Suite 8.7 and 8.8 and in other ...

CVE-2019-69809.8

Synacor Zimbra Collaboration Suite 8.7.x through 8.8.11 allows insecure object deserialization in the IMAP component.

CVE-2021-352099.8

An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9....