Arbitrary file upload in Zimbra Collaboration

CVE-2023-34193

File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive information via the ClientUploader function.

Vulnerability class: Unrestricted File Upload

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS 0.012, 67.8th percentile (scored ); unchanged over 30 days. About EPSS.

Affected products

Weakness classification (CWE)

References