CVE-2019-9670

🗓️ 29 May 2019 21:04:28Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1607 Views🌐 WEB

Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 XML External Entity injection vulnerabilit

Reporter	Title	Published	Views	Family All 35
zdt	Zimbra Collaboration Autodiscover Servlet XXE / ProxyServlet SSRF Exploit	11 Apr 201900:00	–	zdt
ICS	Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure	1 Mar 202212:00	–	ics
attackerkb	Zimbra Collaboration Suite Autodiscover XXE	29 May 201900:00	–	attackerkb
attackerkb	CVE-2019-9670	29 May 201900:00	–	attackerkb
BDU FSTEC	The vulnerability of the mailboxd component (Autodiscover/Autodiscover.xml) in the Zimbra Collaboration Suite enterprise email management system allows a hacker to execute an XXE attack.	7 Sep 202100:00	–	bdu_fstec
Circl	CVE-2019-9670	10 Apr 201917:38	–	circl
CISA KEV Catalog	Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference	10 Jan 202200:00	–	cisa_kev
CISA	CISA Adds 15 Known Exploited Vulnerabilities to Catalog	10 Jan 202200:00	–	cisa
CISA	NSA-CISA-FBI Joint Advisory on Russian SVR Targeting U.S. and Allied Networks	15 Apr 202100:00	–	cisa
Cvelist	CVE-2019-9670	29 May 201921:04	–	cvelist

NVD

Node

Source	Link
wiki	www.wiki.zimbra.com/wiki/Zimbra_Security_Advisories
exploit-db	www.exploit-db.com/exploits/46693/
packetstormsecurity	www.packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
bugzilla	www.bugzilla.zimbra.com/show_bug.cgi
rapid7	www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
isc	www.isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
data	request body	/autodiscover	XML External Entity (XXE) injection in Autodiscover endpoint to disclose local Zimbra configuration and LDAP password.	CWE-611
data	request body	/service/soap/	SOAP AuthRequest flow to obtain a user cookie (ZM_AUTH_TOKEN) using leaked credentials.	CWE-611
target	query param	/service/proxy/	ProxyServlet SSRF using the target parameter to reach internal admin port and obtain an admin cookie.	CWE-611
data	path	/service/admin/soap/AuthRequest	Internal admin authentication endpoint used as the SSRF target by the ProxyServlet.	CWE-611
clientFile	upload data	/service/extension/clientUploader/upload	Multipart upload to place a JSP webshell on the Zimbra server after admin authentication.	CWE-611
stager_name	path	/downloads/{stager_name}	Trigger execution of the uploaded JSP webshell to gain command execution.	CWE-611

17 Jun 2026 02:44Current

9.6Critical risk

Vulners AI Score9.6

CVSS 27.5

CVSS 3.19.8

EPSS0.99986

SSVC