Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in

CVE-2019-9621

🗓️ 30 Apr 2019 17:40:53Reported by mitreType 
cve
 cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 435 Views🌐 WEB

Zimbra Collaboration Suite SSRF vulnerabilit

Related
Detection
Refs
Paths
Social
ReporterTitlePublishedViews
Family
zdt
zdt		Zimbra Collaboration Autodiscover Servlet XXE / ProxyServlet SSRF Exploit
11 Apr 201900:00
–zdt
zdt
zdt		Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery Vulnerability
6 Jun 201900:00
–zdt
githubexploit
GithubExploit		Exploit for Server-Side Request Forgery in Synacor Zimbra_Collaboration_Suite
6 May 201915:47
–githubexploit
attackerkb
ATTACKERKB		Zimbra Collaboration Suite ProxyServlet SSRF
30 Apr 201900:00
–attackerkb
bdu_fstec
BDU FSTEC		The vulnerability of the Zimbra Collaboration Suite’s email management system, which stems from insufficient validation of incoming requests, allows attackers to carry out SRF attacks.
16 Oct 202400:00
–bdu_fstec
circl
Circl		CVE-2019-9621
10 Apr 201917:38
–circl
cisa_kev
CISA KEV Catalog		Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
7 Jul 202500:00
–cisa_kev
cisa
CISA		 CISA Adds Four Known Exploited Vulnerabilities to Catalog
7 Jul 202512:00
–cisa
cvelist
Cvelist		CVE-2019-9621
30 Apr 201917:40
–cvelist
exploitdb
Exploit DB		Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)
12 Apr 201900:00
–exploitdb
Rows per page
NVD
Node
OR
synacorzimbra_collaboration_suiteRange<8.6.0
synacorzimbra_collaboration_suiteRange8.7.0–8.7.11
synacorzimbra_collaboration_suiteRange8.8.0–8.8.9
synacorzimbra_collaboration_suiteMatch8.6.0-
synacorzimbra_collaboration_suiteMatch8.6.0patch1
synacorzimbra_collaboration_suiteMatch8.6.0patch10
synacorzimbra_collaboration_suiteMatch8.6.0patch11
synacorzimbra_collaboration_suiteMatch8.6.0patch12
synacorzimbra_collaboration_suiteMatch8.6.0patch2
synacorzimbra_collaboration_suiteMatch8.6.0patch3
synacorzimbra_collaboration_suiteMatch8.6.0patch4
synacorzimbra_collaboration_suiteMatch8.6.0patch5
synacorzimbra_collaboration_suiteMatch8.6.0patch6
synacorzimbra_collaboration_suiteMatch8.6.0patch7
synacorzimbra_collaboration_suiteMatch8.6.0patch8
synacorzimbra_collaboration_suiteMatch8.6.0patch9
synacorzimbra_collaboration_suiteMatch8.7.11-
synacorzimbra_collaboration_suiteMatch8.7.11patch1
synacorzimbra_collaboration_suiteMatch8.7.11patch10
synacorzimbra_collaboration_suiteMatch8.7.11patch2
synacorzimbra_collaboration_suiteMatch8.7.11patch3
synacorzimbra_collaboration_suiteMatch8.7.11patch4
synacorzimbra_collaboration_suiteMatch8.7.11patch5
synacorzimbra_collaboration_suiteMatch8.7.11patch6
synacorzimbra_collaboration_suiteMatch8.7.11patch7
synacorzimbra_collaboration_suiteMatch8.7.11patch8
synacorzimbra_collaboration_suiteMatch8.7.11patch9
synacorzimbra_collaboration_suiteMatch8.8.9-
synacorzimbra_collaboration_suiteMatch8.8.9p5
synacorzimbra_collaboration_suiteMatch8.8.9patch1
synacorzimbra_collaboration_suiteMatch8.8.9patch2
synacorzimbra_collaboration_suiteMatch8.8.9patch3
synacorzimbra_collaboration_suiteMatch8.8.9patch4
synacorzimbra_collaboration_suiteMatch8.8.9patch6
synacorzimbra_collaboration_suiteMatch8.8.9patch7
synacorzimbra_collaboration_suiteMatch8.8.9patch8
synacorzimbra_collaboration_suiteMatch8.8.9patch9
synacorzimbra_collaboration_suiteMatch8.8.10-
synacorzimbra_collaboration_suiteMatch8.8.10patch1
synacorzimbra_collaboration_suiteMatch8.8.10patch2
synacorzimbra_collaboration_suiteMatch8.8.10patch3
synacorzimbra_collaboration_suiteMatch8.8.10patch4
synacorzimbra_collaboration_suiteMatch8.8.10patch6
synacorzimbra_collaboration_suiteMatch8.8.10patch7
synacorzimbra_collaboration_suiteMatch8.8.11-
synacorzimbra_collaboration_suiteMatch8.8.11patch1
synacorzimbra_collaboration_suiteMatch8.8.11patch2
synacorzimbra_collaboration_suiteMatch8.8.11patch3
ParameterPositionPathDescriptionCWE
Autodiscover.xml payloadrequest bodyAutodiscover/Autodiscover.xmlXXE payload delivered via Autodiscover.xml to retrieve data or modify local files.CWE-918
targetquery paramservice/proxySSRF via ProxyServlet to access internal service endpoints (e.g., https://127.0.0.1:7071/service/admin/soap).CWE-918
clientFilenestedservice/extension/clientUploader/uploadUpload of a crafted file (e.g., shell.jsp) to attacker-controlled location after SSRF/authentication bypass.CWE-918
filename1nestedservice/extension/clientUploader/uploadUpload of a crafted file (e.g., shell.jsp) to attacker-controlled location after SSRF/authentication bypass.CWE-918
requestIdnestedservice/extension/clientUploader/uploadUpload of a crafted file (e.g., shell.jsp) to attacker-controlled location after SSRF/authentication bypass.CWE-918

_cybersecurity_

CISAFlagsFourCriticalVulnerabilitiesAmidRisingThreats

久々にハニーポット覗いてみた。ZimbraのXXE Injection/SSRFの脆弱性(CVE-2019-9621)を狙った通信が12/4から増加している模様。(/autodiscover もしくは /Autodiscover/Autodiscover.xml)

45[.]146[.]165[.]157 attack attempt: POST /Autodiscover/Autodiscover.xml CVE-2019-9621 JAVA XML Injection most difficalt part to find "bad" good music : ;))))))))))))))))))))))))))))))))))))))))))))

cyber_sec_raj

CISA added 5 vulns to its Known Exploited Vulnerabilities (KEV) catalog this week: CitrixBleed 2 (CVE-2025-5777) – OOB read in NetScaler ADC. 4 older vulns added July 7: Zimbra ZCS (CVE-2019-9621) Rails (CVE-2019-5418) PHPMailer (CVE-2016-10033) MRLG (CVE-2014-3931)

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
17 Jun 2026 02:44Current
7.5High risk
Vulners AI Score7.5
CVSS 25
CVSS 3.17.5
EPSS0.81037
SSVC
CWE-918In Wild
cve-2019-9621zimbra collaboration suitessrfproxyservletnvd
435