SSRF in Zimbra Collaboration

CVE-2024-45518

An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE).

Vulnerability class: SSRF (Server-Side Request Forgery)

Published · last modified .

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

EPSS exploit prediction

EPSS 0.207, 97.6th percentile (scored ); unchanged over 30 days. About EPSS.

Affected products

Weakness classification (CWE)

Public exploits and proof-of-concept code

Also mentioned in 2 other repositories (ARPSyndicate/cve-scores, fkie-cad/nvd-json-data-feeds). These reference the CVE in a list, notes or a scanner and are not exploit code for it.

References