Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference

[ Why it matters ]Priority signals

• Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-01-10
• EPSS: 100% chance of exploitation in the next 30 days (higher than 100% of CVEs)
• Critical severity: CVSS 9.8

[ Description ]Official description

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

CISA: Synacor Zimbra Collaboration Suite (ZCS) contains an improper restriction of XML external entity (XXE) vulnerability in the mailboxd component.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 10 Jul 2022): Apply updates per vendor instructions.

• Patch on bugzilla.zimbra.comVendor patch or bulletin · NVD · Reference tagged 'Patch' by NVD

[ References ]References

• packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-Prox…ExploitThird Party AdvisoryVDB Entry
• www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rceThird Party Advisory
• bugzilla.zimbra.com/show_bug.cgiBroken LinkIssue TrackingPatch
• isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570ExploitThird Party Advisory
• wiki.zimbra.com/wiki/Zimbra_Security_AdvisoriesVendor Advisory
• www.exploit-db.com/exploits/46693ExploitThird Party AdvisoryVDB Entry
• www.cisa.gov/known-exploited-vulnerabilities-catalogUS Government Resource