CVE-2019-9621highunder attackCWE-918

CVE-2019-9621

Published · Updated

Follow this CVE+ Monitor Zimbra Collaboration Suite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 81%
from disclosure to weaponsame day
Published on NVDApr 30
1st PoCApr 12
metasploitMar 13
CISA KEV+2260d
Action required by CISAfederal deadline: 2025-07-28

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Zimbra email servers before certain patch versions allow attackers to make requests to internal servers by exploiting the ProxyServlet component. This lets attackers access systems they shouldn't be able to reach from the internet.

Technical detail

Server-Side Request Forgery (SSRF) vulnerability in Zimbra's ProxyServlet allows unauthenticated or low-privileged attackers to forge HTTP requests to internal network resources. The vulnerability affects unpatched versions of Collaboration Suite 8.6, 8.7.x, and 8.8.x, potentially exposing internal services and sensitive data.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.