CVE-2022-37042criticalunder attackransomwareCWE-22

CVE-2022-37042

Published · Updated

Follow this CVE+ Monitor Zimbra Collaboration Suite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 92%
from disclosure to weapon7 days
Published on NVDAug 11
1st PoC+7d
metasploitMay 10
CISA KEVAug 11
Action required by CISAfederal deadline: 2022-09-01

Apply updates per vendor instructions.

In short

A flaw in Zimbra Collaboration Suite allows attackers to bypass login requirements and upload malicious files to the server, potentially taking complete control of the system. This happens through a feature that processes compressed archives without proper security checks.

Technical detail

CVE-2022-37042 is a directory traversal and remote code execution vulnerability in the mboximport functionality of Zimbra ZCS 8.8.15 and 9.0. An unauthenticated attacker can upload a crafted ZIP archive containing specially-crafted paths to extract files outside intended directories, bypassing authentication requirements and achieving code execution with server privileges. This represents an incomplete remediation of CVE-2022-27925.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.