CVE-2024-45519criticalunder attackCWE-78

CVE-2024-45519

Published · Updated

Follow this CVE+ Monitor Zimbra Collaboration Suite

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 100%
from disclosure to weaponsame day
Published on NVDOct 2
1st PoCSep 28
CISA KEV+1d
Action required by CISAfederal deadline: 2024-10-24

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

An unauthenticated attacker can execute arbitrary commands on a Zimbra email server through the postjournal service, bypassing all security protections without needing valid credentials.

Technical detail

The postjournal service in Zimbra Collaboration contains an unauthenticated command execution vulnerability (CWE-78, OS Command Injection). An attacker can send specially crafted requests to the vulnerable service to execute arbitrary commands with the privileges of the Zimbra process, affecting versions before 8.8.15 Patch 46, 9.0.0 Patch 41, 10.0.9, and 10.1.1.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.