Multiple RCE vulnerabilities impact all versions of Zimbra email software

guest · Mar 16, 2019

Multiple RCE vulnerabilities impact all versions of Zimbra email software
Patches released for latest builds, but older versions are still vulnerable
March 15, 2019
https://portswigger.net/daily-swig/...-impact-all-versions-of-zimbra-email-software

All versions of Zimbra are said to have been impacted, but the issue has now been fixed in 8.7.11 and 8.8x, the latest versions.

Researcher An Trinh (who goes by the Twitter handle @_tint0) said that Zimbra’s reliance of Extensible Markup Language (XML) for encoding its operations laid the path for multiple vulnerabilities – CVE-2016-9924, CVE-2018-20160, and CVE-2019-9670.

These are all XML external entity injection (XXE) vulnerabilities, which arise when applications process user-supplied XML documents without disabling references to external resources.
“For more recent versions, CVE-2019-9670 works flawlessly where the XXE lies in the handling of Autodiscover requests,” Trinh said in a blog post published this week, explaining how the exploit could be leveraged on Zimbra versions 8.5 to 8.7.11.
Click to expand...

Log in or Sign up

Multiple RCE vulnerabilities impact all versions of Zimbra email software

guest Guest

Log in or Sign up

Multiple RCE vulnerabilities impact all versions of Zimbra email software

guest Guest

Useful Searches