{"id":"CVE-2022-37042","url":"https://www.cyber-defence.io/tools/cve/CVE-2022-37042","generatedAt":"2026-10-31T12:57:12.923Z","title":"Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability","description":"Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.","published":"2022-08-12T15:15:16.000Z","lastModified":"2026-08-04T05:16:29.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-22"],"affected":["synacor/zimbra collaboration suite"],"epss":{"score":0.92072,"percentile":0.9982,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2022-08-11","dueDate":"2022-09-01","knownRansomwareCampaignUse":"Known","notes":"Apply updates per vendor instructions.\nhttps://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/;  https://nvd.nist.gov/vuln/detail/CVE-2022-37042"},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 1 September 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Patch","Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Patch","Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37042","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-37042","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}