CVE-2019-9670

🗓️ 29 May 2019 21:04:28Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1503 Views🌐 WEB

Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 XML External Entity injection vulnerabilit

Reporter	Title	Published	Views	Family All 32
0day.today	Zimbra Collaboration Autodiscover Servlet XXE / ProxyServlet SSRF Exploit	11 Apr 201900:00	–	zdt
ICS	Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure	1 Mar 202212:00	–	ics
ATTACKERKB	Zimbra Collaboration Suite Autodiscover XXE	29 May 201900:00	–	attackerkb
ATTACKERKB	CVE-2019-9670	29 May 201900:00	–	attackerkb
BDU FSTEC	The vulnerability of the mailboxd component (Autodiscover/Autodiscover.xml) in the Zimbra Collaboration Suite enterprise email management system allows a hacker to execute an XXE attack.	7 Sep 202100:00	–	bdu_fstec
Circl	CVE-2019-9670	10 Apr 201917:38	–	circl
CISA KEV Catalog	Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference	10 Jan 202200:00	–	cisa_kev
CISA	CISA Adds 15 Known Exploited Vulnerabilities to Catalog	10 Jan 202200:00	–	cisa
CISA	NSA-CISA-FBI Joint Advisory on Russian SVR Targeting U.S. and Allied Networks	15 Apr 202100:00	–	cisa
Cvelist	CVE-2019-9670	29 May 201921:04	–	cvelist

NVD

Node

Source	Link
wiki	www.wiki.zimbra.com/wiki/Zimbra_Security_Advisories
exploit-db	www.exploit-db.com/exploits/46693/
packetstormsecurity	www.packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
bugzilla	www.bugzilla.zimbra.com/show_bug.cgi
rapid7	www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
isc	www.isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
XML payload in Autodiscover request body	request body	/autodiscover	XXE in Autodiscover servlet enabling reading local files (e.g., Zimbra config) via XML external entities	CWE-611
target	query param	/service/proxy/	SSRF via Proxy Servlet forwarding crafted AuthRequest to admin port to obtain admin cookie	CWE-611
clientFile	upload data	/service/extension/clientUploader/upload	Upload of JSP webshell after admin cookie obtained, enabling remote code execution	CWE-611

17 Jun 2026 02:44Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 3.19.8

EPSS0.99986

SSVC