Junglewise Threat Intelligence

CVE-2022-27925: Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability

CVE-2022-27925 · Severity: critical · CVSS 7.2 · Exploited in the wild · Published 2022-08-11

Technologies: Synacor Zimbra Collaboration Suite (ZCS). Vendors: Synacor.

Executive brief

Synacor Zimbra Collaboration Suite (ZCS) contains a directory traversal vulnerability in its mboximport functionality. An authenticated administrator can upload a malicious ZIP archive to extract arbitrary files to the system, potentially leading to remote code execution. This vulnerability has been observed being chained with CVE-2022-37042 to achieve unauthenticated remote code execution.

Affected products

  • Synacor Zimbra Collaboration Suite (ZCS) 8.8.15, 9.0.0

Timeline

  • 2022-08-11: disclosed
  • 2022-08-11: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
  • 2022-08-11: advisory

Related threats