Vulnerability · Published Jun 3, 2020 · Assigned by mitre

CVE-2020-12846

High 8.0

In plain English

A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities).

Severity (CVSS NVD)8.0High

Exploit odds (30 days)2.6%top 14.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe,sh,bat,jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a "Corrupt File" error, but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/, leaving it open to possible remote execution.

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories x_refsource_MISC
https://wiki.zimbra.com/wiki/Security_Center x_refsource_MISC
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P3 x_refsource_CONFIRM