CVE-2023-38750

HighCVSS 7.5

Published: 31/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.73%

49th percentile - higher than 49% of all known CVEs

Summary

In Zimbra Collaboration (ZCS) versions 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, there is a risk of exposure of internal JSP and XML files.

Risk Assessment

The exposure of these files may lead to the leakage of sensitive information, posing a threat to the organization's data security.

Recommendation

It is recommended to update Zimbra Collaboration to the latest version to minimize the risk associated with this vulnerability.

Other vulnerabilities in Zimbra Collaboration (ZCS)

CVE-2022-41352CriticalActively exploited
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio.

Original NVD description (English source)

In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exposed.