CVE-2019-9621

KEV
Published: Apr 30, 2019 Last Modified: Nov 04, 2025
ExploitDB:
Other exploit source:
Google Dorks:
HIGH 7,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: none
Availability: none
MEDIUM 5,0
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: none
Confidentiality: partial
Integrity: none
Availability: none

Description

AI Translation Available

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score
0,9412
Percentile
1,0th
Updated

EPSS Score Trend (Last 90 Days)

918

Server-Side Request Forgery (SSRF)

Incomplete
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality Integrity Access Control
Potential Impacts:
Read Application Data Execute Unauthorized Code Or Commands Bypass Protection Mechanism
Applicable Platforms
Technologies: AI/ML, Web Based, Web Server
View CWE Details
Exploit

Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet …

Verified Server-Side Request Forgery (SSRF)

Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)

Author: Metasploit Published: Status: Verified
View Exploit Code →
Exploit

Zimbra < 8.8.11 - XML External Entity Injection …

Server-Side Request Forgery (SSRF)

Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery

Author: k8gege Published:
View Exploit Code →
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.9
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.10
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version Range Affected
From 8.8.0 (inclusive)
To 8.8.9 (exclusive)
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.10
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch7:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.7.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch7:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.9
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch6:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.10
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch10:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.7.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch9:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.7.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch6:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.7.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch8:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.7.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch5:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.9
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch9:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch5:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch11:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.10
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.11:patch1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.11:patch3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.9
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch4:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.7.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch4:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.9
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch8:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.9
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.10
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch6:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.9
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version Range Affected
From 8.7.0 (inclusive)
To 8.7.11 (exclusive)
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch12:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.11:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.7.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.7.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch8:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch6:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.7.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.7.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.7.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:patch10:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.10
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:patch4:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch4:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version Range Affected
To 8.6.0 (exclusive)
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch9:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.11
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.11:patch2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.9
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:p5:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.9
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.9
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.9:patch7:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.8.10
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.10:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application

Zimbra Collaboration Suite by Synacor

Product Information
Vendor Synacor
Product Zimbra Collaboration Suite
Version 8.6.0
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.6.0:patch7:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalo…
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019…
http://packetstormsecurity.com/files/152487/Zimbra-Collabor…
http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-S…
http://packetstormsecurity.com/files/153190/Zimbra-XML-Inje…
http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Re…
https://blog.tint0.com/2019/03/a-saga-of-code-executions-on…
https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html
https://blog.zimbra.com/2019/03/9826/
https://blog.zimbra.com/2019/03/9826/
https://bugzilla.zimbra.com/show_bug.cgi?id=109127
https://bugzilla.zimbra.com/show_bug.cgi?id=109127
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://www.exploit-db.com/exploits/46693/
https://www.exploit-db.com/exploits/46693/
http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_…
http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
http://packetstormsecurity.com/files/152487/Zimbra-Collabor…
http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-S…
http://packetstormsecurity.com/files/153190/Zimbra-XML-Inje…
http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Re…
https://blog.tint0.com/2019/03/a-saga-of-code-executions-on…
https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html
https://blog.zimbra.com/2019/03/9826/
https://blog.zimbra.com/2019/03/9826/
https://bugzilla.zimbra.com/show_bug.cgi?id=109127
https://bugzilla.zimbra.com/show_bug.cgi?id=109127
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Security_Center
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://www.exploit-db.com/exploits/46693/
https://www.exploit-db.com/exploits/46693/
http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_…
http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce