Vulnerability · Published Aug 16, 2022 · Assigned by rapid7
CVE-2022-37393Zimbra zmslapd arbitrary module load
High 7.8
In plain English
A high-severity improper access control in Zimbra Server from Synacor. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Severity (CVSS NVD)7.8High
Exploit odds (30 days)1.7%top 23.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Metasploit
Official description
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Synacor | Zimbra Server | 9.0.0.p27 – through 9.0.0.p278.8.15.p34 – through 8.8.15.p34 |
Weakness: CWE-284
References
- https://github.com/rapid7/metasploit-framework/pull/16807 x_refsource_MISC
- https://attackerkb.com/topics/92AeLOE1M1/cve-2022-37393/rapid7-analysis x_refsource_MISC
- https://darrenmartyn.ie/2021/10/27/zimbra-zmslapd-local-root-exploit/ x_refsource_MISC