CVE-2022-27925

תיאור (מקור, אנגלית)

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

מדדים

CVSS 3.1

7.2 (HIGH) מקור הציון: NVD CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

99% (אחוזון 100) נכון ל-25/7/2026

CWE

CWE-22

מוצרים מושפעים

synacor: zimbra collaboration suite

קישורים

• https://wiki.zimbra.com/wiki/Security_Center Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24 Release NotesVendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
• https://wiki.zimbra.com/wiki/Security_Center Vendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24 Release NotesVendor Advisory
• https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories Vendor Advisory
• http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html ExploitThird Party AdvisoryVDB Entry
• http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html ExploitThird Party AdvisoryVDB Entry
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-202‮… US Government Resource