Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability

概要

参考情報

• packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html · Exploit
• packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html · Exploit
• rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce · Exploit
• blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html · Third Party Advisory
• blog.zimbra.com/2019/03/9826 · Vendor Advisory
• bugzilla.zimbra.com/show_bug.cgi · Issue Tracking
• wiki.zimbra.com/wiki/Security_Center · Release Notes
• wiki.zimbra.com/wiki/Zimbra_Security_Advisories · Vendor Advisory
• exploit-db.com/exploits/46693 · Exploit
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource

zimbra collaboration suite のその他の脆弱性

• CVE-2026-93638中 6.1A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to e…
• CVE-2026-93636中 4.3An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attrib…
• CVE-2026-93634中 4.3A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file re…
• CVE-2026-93633中 5.4A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a documen…
• CVE-2026-93631高 7.1A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to …