Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Critical CVSS 9.8 Listed in CISA KEV
Summary
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- Synacor:Zimbra Collaboration Suite (ZCS)
- :
- :
Sources
- CISA KEV DATABASE
- NVD DATABASE
Original Links
- https://nvd.nist.gov/vuln/detail/CVE-2022-41352 advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog kev
- https://wiki.zimbra.com/wiki/Security_Center; reference
- http://packetstormsecurity.com/files/169458/Zimbra-Collaboration-Suite-TAR-Path-Traversal.html Exploit
- https://forums.zimbra.org/viewtopic.php?t=71153&p=306532 Mitigation
- https://wiki.zimbra.com/wiki/Security_Center Patch
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://www.secpod.com/blog/unpatched-rce-bug-in-zimbra-collaboration-suite-exploited-in-wild/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41352 US Government Resource
Timeline
- kev_added CISA KEV
- kev_ingest CISA KEV
- nvd_ingest NVD