CVE-2022-27925

Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

Zimbra Collaboration Suite

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

21. Apr 2022

Ausgewertete Quellen

• Hersteller
  https://wiki.zimbra.com/wiki/Security_Center
• Hersteller
  https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24
• Hersteller
  https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
• Hinweis
  http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-27925
• CISA
  Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
• NVD
  CVE-2022-27925