Log in Start free

Actively exploited · Published Sep 26, 2022 · Assigned by mitre

CVE-2022-41352

Critical 9.8 Exploited Ransomware

In plain English

A critical-severity path traversal in Zimbra Collaboration Suite (ZCS) from Synacor. Attackers are actively exploiting it in the wild (listed by CISA on October 20, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 95.5% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)95.5%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Oct 20, 2022
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 10, 2022.

Official description

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References