CVE-2019-9670

🗓️ 29 May 2019 21:04:28Reported by mitreType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 1457 Views🌐 WEB

Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 XML External Entity injection vulnerabilit

Reporter	Title	Published	Views	Family All 32
0day.today	Zimbra Collaboration Autodiscover Servlet XXE / ProxyServlet SSRF Exploit	11 Apr 201900:00	–	zdt
ICS	Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure	1 Mar 202212:00	–	ics
ATTACKERKB	Zimbra Collaboration Suite Autodiscover XXE	29 May 201900:00	–	attackerkb
ATTACKERKB	CVE-2019-9670	29 May 201900:00	–	attackerkb
BDU FSTEC	The vulnerability of the mailboxd component (Autodiscover/Autodiscover.xml) in the Zimbra Collaboration Suite enterprise email management system allows a hacker to execute an XXE attack.	7 Sep 202100:00	–	bdu_fstec
Circl	CVE-2019-9670	10 Apr 201917:38	–	circl
CISA KEV Catalog	Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference	10 Jan 202200:00	–	cisa_kev
CISA	CISA Adds 15 Known Exploited Vulnerabilities to Catalog	10 Jan 202200:00	–	cisa
CISA	NSA-CISA-FBI Joint Advisory on Russian SVR Targeting U.S. and Allied Networks	15 Apr 202100:00	–	cisa
Cvelist	CVE-2019-9670	29 May 201921:04	–	cvelist

NVD

Node

Source	Link
wiki	www.wiki.zimbra.com/wiki/Zimbra_Security_Advisories
exploit-db	www.exploit-db.com/exploits/46693/
packetstormsecurity	www.packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
bugzilla	www.bugzilla.zimbra.com/show_bug.cgi
rapid7	www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
isc	www.isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog

Parameter	Position	Path	Description	CWE
EMailAddress	request body	autodiscover	XXE in Autodiscover to read local config and extract credentials	CWE-611
AcceptableResponseSchema	request body	autodiscover	XXE in Autodiscover to read local config and extract credentials	CWE-611
target	query param	service/proxy/	SSRF via ProxyServlet to admin port using AuthRequest with zimbra credentials	CWE-611
AuthRequest	request body	service/soap/	Auth flow to obtain user/admin cookies enabling further exploitation	CWE-611
password	request body	service/soap/	Auth flow to obtain user/admin cookies enabling further exploitation	CWE-611
account	request body	service/soap/	Auth flow to obtain user/admin cookies enabling further exploitation	CWE-611
filename1	binary	service/extension/clientUploader/upload	Upload of JSP webshell after obtaining admin cookie	CWE-611
clientFile	binary	service/extension/clientUploader/upload	Upload of JSP webshell after obtaining admin cookie	CWE-611
requestId	binary	service/extension/clientUploader/upload	Upload of JSP webshell after obtaining admin cookie	CWE-611

04 Nov 2025 16:46Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

CVSS 3.19.8

EPSS0.94428

SSVC