CVE-2019-9670
CRITICAL
9,8
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
HIGH
7,5
Source: [email protected]
Access Vector: network
Access Complexity: low
Authentication: none
Confidentiality: partial
Integrity: partial
Availability: partial
Description
AI Translation Available
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,9443
Percentile
1,0th
Updated
EPSS Score Trend (Last 90 Days)
611
Improper Restriction of XML External Entity Reference
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Availability
Potential Impacts:
Read Application Data
Read Files Or Directories
Bypass Protection Mechanism
Dos: Resource Consumption (Cpu)
Dos: Resource Consumption (Memory)
Applicable Platforms
Languages:
Not Language-Specific, XML
Technologies:
Not Technology-Specific, Web Based
Exploit
Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet …
Verified Server-Side Request Forgery (SSRF)Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)
View Exploit Code →
Application
Zimbra Collaboration Suite by Synacor
CPE Identifier
View Detailed Analysis
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p6:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Zimbra Collaboration Suite by Synacor
CPE Identifier
View Detailed Analysis
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Zimbra Collaboration Suite by Synacor
CPE Identifier
View Detailed Analysis
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p9:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Zimbra Collaboration Suite by Synacor
CPE Identifier
View Detailed Analysis
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Zimbra Collaboration Suite by Synacor
CPE Identifier
View Detailed Analysis
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p7:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Zimbra Collaboration Suite by Synacor
Version Range Affected
From
8.7.0
(inclusive)
To
8.7.11
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Zimbra Collaboration Suite by Synacor
CPE Identifier
View Detailed Analysis
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Zimbra Collaboration Suite by Synacor
CPE Identifier
View Detailed Analysis
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p8:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Zimbra Collaboration Suite by Synacor
CPE Identifier
View Detailed Analysis
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Zimbra Collaboration Suite by Synacor
CPE Identifier
View Detailed Analysis
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Application
Zimbra Collaboration Suite by Synacor
CPE Identifier
View Detailed Analysis
cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019…
http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-S…
https://bugzilla.zimbra.com/show_bug.cgi?id=109129
https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vu…
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://www.exploit-db.com/exploits/46693/
http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-S…
https://bugzilla.zimbra.com/show_bug.cgi?id=109129
https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vu…
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
https://www.exploit-db.com/exploits/46693/
http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce