Evil-DB LogoEvil-DB
← All CVEs

CVE-2022-37042

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2022-08-11Remediation due 2022-09-01

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

9.8
CVSS
91.9%
EPSS (exploit prob.)
100th
EPSS percentile
2022-08-12
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-22

Affected products

VendorProductAffected versions
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite8.8.15
synacorzimbra_collaboration_suite9.0.0
synacorzimbra_collaboration_suite9.0.0
synacorzimbra_collaboration_suite9.0.0
synacorzimbra_collaboration_suite9.0.0
synacorzimbra_collaboration_suite9.0.0
synacorzimbra_collaboration_suite9.0.0

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2022-37042