Actively exploited in the wild
Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
Synacor - Zimbra Collaboration Suite (ZCS) · Listed in the CISA KEV since 2024-10-03. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2024-45519
CriticalCVSS 10.0KEVSummary
The postjournal service in Zimbra Collaboration (ZCS) before certain versions sometimes allows unauthenticated users to execute commands.
Risk Assessment
An unauthenticated attacker can execute commands on the Zimbra server, potentially leading to full compromise of the mail system.
Recommendation
Update Zimbra Collaboration to a patched version (8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9, or 10.1.1).
Other vulnerabilities in Zimbra Collaboration (ZCS)
See all- CVE-2022-41352CriticalActively exploited
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio.
- CVE-2023-38750High
In Zimbra Collaboration (ZCS) versions 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, there is a risk of exposure of internal JSP and XML files.
Original NVD description (English source)
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.