VulnerabilityAnalyzed
CVE-2019-9670
Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
KEVCRITICAL 9.8EPSS 100.0%
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 10 July 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 99.99% probability · 100th percentile
- CISA KEV
- Listed 10 January 2022 · due 10 July 2022
- Weakness
- CWE-611
- Affected
- synacor/zimbra collaboration suite
- Source
- cve@mitre.org
CISA notes
Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-9670
References
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.htmlExploit, Third Party Advisory, VDB Entry
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rceThird Party Advisory
- https://bugzilla.zimbra.com/show_bug.cgi?id=109129Broken Link, Issue Tracking, Patch, Third Party Advisory
- https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/Exploit, Third Party Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
- https://www.exploit-db.com/exploits/46693/Exploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.htmlExploit, Third Party Advisory, VDB Entry
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rceThird Party Advisory
- https://bugzilla.zimbra.com/show_bug.cgi?id=109129Broken Link, Issue Tracking, Patch, Third Party Advisory
- https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/Exploit, Third Party Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
- https://www.exploit-db.com/exploits/46693/Exploit, Third Party Advisory, VDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9670US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.