CVE-2019-9670
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.
Groups known to exploit this vulnerability (MITRE ATT&CK attribution).
Apply updates per vendor instructions.
Zimbra Collaboration Suite has a vulnerability where attackers can inject malicious XML code through the Autodiscover feature, potentially allowing them to read sensitive files or cause denial of service without needing special access.
An XML External Entity (XXE) injection vulnerability exists in the mailboxd component's Autodiscover.xml endpoint, allowing unauthenticated attackers to craft malicious XML payloads that trigger entity expansion or external entity processing, leading to information disclosure or server resource exhaustion.
The full analysis of this CVE is available in Portuguese →