Lucene search

GoogleOSV:CVE-2022-45912

HistoryDec 05, 2022 - 10:15 p.m.

CVE-2022-45912

2022-12-0522:15:11

Google

osv.dev

zimbra collaboration

remote code execution

clientuploader

authenticated admin user

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.7%

JSON

An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An authenticated admin user can upload files through the ClientUploader utility, and traverse to any other directory for remote code execution.

CPENameOperatorVersion
zm-buildeq8.8.9.p1
zm-buildeq8.8.8
zm-buildeq8.8.7
zm-buildeq8.8.6
zm-buildeq8.7.9
zm-buildeq8.8.11
zm-buildeq8.8.9
zm-buildeq8.8.3
zm-buildeq8.7.10
zm-buildeq8.8.0.beta1

Name	Operator	Version
zm-build	eq	8.8.9.p1
zm-build	eq	8.8.8
zm-build	eq	8.8.7
zm-build	eq	8.8.6
zm-build	eq	8.7.9
zm-build	eq	8.8.11
zm-build	eq	8.8.9
zm-build	eq	8.8.3
zm-build	eq	8.7.10
zm-build	eq	8.8.0.beta1

Rows per page:

1-10 of 201

References

gist.github.com/Threonic/e90c85e11e1ac925ff57783988779e76

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.7%

JSON

Related for OSV:CVE-2022-45912