by Kastro
Paper/Archive/CVE-2024-45519

CVE-2024-45519

Synacor Zimbra Collaboration Suite (ZCS) — Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability

KEV · due 24 OctEPSS 100%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

Affected

ProductAffectedFixed inSource
n/an/a–CNA

Scores by source

mitre (CNA)10.0CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refwiki.zimbra.com/wiki/Security_Centerrefwiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policyrefwiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixesrefwiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixesrefwiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixesrefwiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixesexploitblog.projectdiscovery.io/zimbra-remote-code-executionrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45519kevcisa.gov/known-exploited-vulnerabilities-catalog