CVE-2023-38750
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk49th percentile - higher than 49% of all known CVEs
Summary
In Zimbra Collaboration (ZCS) versions 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, there is a risk of exposure of internal JSP and XML files.
Risk Assessment
The exposure of these files may lead to the leakage of sensitive information, posing a threat to the organization's data security.
Recommendation
It is recommended to update Zimbra Collaboration to the latest version to minimize the risk associated with this vulnerability.
Other vulnerabilities in Zimbra Collaboration (ZCS)
See all- CVE-2024-45519CriticalActively exploited
The postjournal service in Zimbra Collaboration (ZCS) before certain versions sometimes allows unauthenticated users to execute commands.
- CVE-2022-41352CriticalActively exploited
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio.
Original NVD description (English source)
In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS