Actively exploited · Published May 29, 2019 · Assigned by mitre
CVE-2019-9670
Critical 9.8 Exploited
In plain English
A critical-severity XML external entity in Zimbra Collaboration Suite (ZCS) from Synacor. Attackers are actively exploiting it in the wild (listed by CISA on January 10, 2022). The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 10, 2022.
Official description
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
Affected products (as reported)
Weakness: CWE-611 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories x_refsource_MISC
- https://bugzilla.zimbra.com/show_bug.cgi?id=109129 x_refsource_MISC
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce x_refsource_MISC
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html x_refsource_MISC
- 46693 exploit, x_refsource_EXPLOIT-DB
- https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/ x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9670 government-resource