Actively exploited
Listed in CISA’s Known Exploited Vulnerabilities catalog since October 20, 2022.
CVE-2022-41352
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Synacor · Zimbra Collaboration Suite (ZCS)
Added to KEV October 20, 2022
Alert details
- Source feed
- CISA KEV
- CVE ID
- CVE-2022-41352
- CWE
- CWE-22
- Affected products
- Zimbra Collaboration Suite (ZCS) · Synacor Zimbra Collaboration Suite (ZCS) · Synacor
What happened
Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts.
What it means for your business
Synacor Zimbra Collaboration Suite (ZCS) is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2022-41352). Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to upload arbitrary files using cpio package to gain incorrect access to any other user accounts. CISA remediation due date: 2022-11-10. If you need help checking exposure, call (864) 335-9223.
Required action
Apply updates per vendor instructions.
CISA due date: November 10, 2022
Sources
Related briefs
Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
Synacor Zimbra Collaboration Suite (ZCS) is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2022-37042). Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution. CISA remediation due date: 2022-09-01. If you need help checking exposure, call (864) 335-9223.
Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability
Synacor Zimbra Collaboration Suite (ZCS) is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2022-27925). Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution. CISA remediation due date: 2022-09-01. If you need help checking exposure, call (864) 335-9223.
Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability
Synacor Zimbra Collaboration Suite (ZCS) is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2022-27924). Synacor Zimbra Collaboration Suite (ZCS) allows an attacker to inject memcache commands into a targeted instance which causes an overwrite of arbitrary cached entries. CISA remediation due date: 2022-08-25. If you need help checking exposure, call (864) 335-9223.
Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability
Synacor Zimbra Collaboration Suite (ZCS) is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2018-6882). Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that might allow remote attackers to inject arbitrary web script or HTML. CISA remediation due date: 2022-05-10. If you need help checking exposure, call (864) 335-9223.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.