Server side request forgery (ssrf)

2020-02-1822:15:00

PRIOn knowledge base

www.prio-n.com

9.4 High

AI Score

Confidence

High

0.74 High

EPSS

Percentile

98.1%

JSON

Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

CPENameOperatorVersion
zimbra_collaboration_suiteeq8.8.15 p1
zimbra_collaboration_suiteeq8.8.15
zimbra_collaboration_suitelt8.8.15
zimbra_collaboration_suiteeq8.8.15 p6
zimbra_collaboration_suiteeq8.8.15 p5
zimbra_collaboration_suiteeq8.8.15 p3
zimbra_collaboration_suiteeq8.8.15 p4
zimbra_collaboration_suiteeq8.8.15 p2

Name	Operator	Version
zimbra_collaboration_suite	eq	8.8.15 p1
zimbra_collaboration_suite	eq	8.8.15
zimbra_collaboration_suite	lt	8.8.15
zimbra_collaboration_suite	eq	8.8.15 p6
zimbra_collaboration_suite	eq	8.8.15 p5
zimbra_collaboration_suite	eq	8.8.15 p3
zimbra_collaboration_suite	eq	8.8.15 p4
zimbra_collaboration_suite	eq	8.8.15 p2

References

wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P7