CVE-2013-7091
82Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actepss 86%
from disclosure to weapon0 days
Published on NVDDec 13
1st PoCDec 6
metasploitDec 6
VulnCheck+3622d
exploitation probability
86%top 1% of all CVEs
observed exploitation
yesVulnCheck
5 public exploit(s)
Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the skin parameter. NOTE: this can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API.
Affected products
n/a · n/apublic PoCs found — 5✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/30085exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/30472cve_referencewww.exploit-db.com/exploits/30085unverifiedcve_referencewww.exploit-db.com/exploits/30472unverifiedcve_referencepacketstormsecurity.com/files/124321unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.