| Package | Affected versions | Patched versions |
|---|---|---|
| zimbra collaboration suite | = 6.0.0= 6.0.1= 6.0.10= 6.0.12= 6.0.13= 6.0.14= 6.0.15= 6.0.16= 6.0.2= 6.0.3= 6.0.4= 6.0.5= 6.0.6= 6.0.7= 6.0.8= 6.0.9 |
Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the skin parameter. NOTE: this can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free