CVE-2019-9670

Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

Zimbra Collaboration Suite

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

30. Mai 2019

Ausgewertete Quellen

• Hersteller
  https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• Hinweis
  http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
• Hinweis
  http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
• Hinweis
  https://bugzilla.zimbra.com/show_bug.cgi?id=109129
• Hinweis
  https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/
• Hinweis
  https://www.exploit-db.com/exploits/46693/
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9670
• CISA
  Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
• NVD
  CVE-2019-9670