CVE-2022-27925highunder attackransomwareCWE-22

CVE-2022-27925

Published · Updated

Follow this CVE+ Monitor Zimbra Collaboration Suite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.2epss 99%
from disclosure to weapon114 days
Published on NVDApr 20
1st PoC+114d
metasploit+20d
CISA KEV+113d
Action required by CISAfederal deadline: 2022-09-01

Apply updates per vendor instructions.

In short

Zimbra Collaboration allows administrators to upload files through a backup import function that doesn't properly check file paths, enabling them to place files anywhere on the system instead of just the intended directory.

Technical detail

The mboximport functionality in Zimbra 8.8.15 and 9.0 fails to validate file paths during ZIP extraction, allowing authenticated administrators to exploit directory traversal (CWE-22) and write arbitrary files to unauthorized locations on the server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.