CVE-2019-9621
High 7.5 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
Metrics
- CVSS 3.1
-
7.5 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - EPSS — exploit probability
- 81% (percentile: 100) as of 2 November 2026
- CWE
- CWE-918
Affected products
synacor: zimbra collaboration suite
References
- https://blog.zimbra.com/2019/03/9826/ Vendor Advisory
- https://wiki.zimbra.com/wiki/Security_Center Release NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- https://blog.zimbra.com/2019/03/9826/ Vendor Advisory
- https://wiki.zimbra.com/wiki/Security_Center Release NotesVendor Advisory
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-S… ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Re… ExploitThird Party AdvisoryVDB Entry
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce ExploitThird Party Advisory
- https://www.exploit-db.com/exploits/46693/ ExploitThird Party AdvisoryVDB Entry