Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/01/2022. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| zimbra collaboration suite | = 8.7.11≥ 8.7.0, < 8.7.11 | 8.7.11 |
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free