CVE-2019-9621

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component...

CVE-2019-9621

The CVE-2019-9621 issue affects Zimbra Collaboration Suite (Prox yServlet) and enables SSRF through the ProxyServlet component. Connected docs confirm affected versions (8.6 patch 13; 8.7.x before 8.7.11 patch 10; 8.8.x before 8.8.10 patch 7 or before 8.8.11 patch 3) and show PoCs/exploits levera...

Zimbra Collaboration Suite ProxyServlet SSRF

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component. Recent assessments: jrobles-r7 at May 09, 2019 5:57pm UTC reported: Details According to the blog post A Saga of...

Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF', 'Description' = %q This module exploits an XML external entity vulnerabilit...

Zimbra Collaboration Autodiscover Servlet XXE / ProxyServlet SSRF

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF', 'Description' = %q This module exploits an XML external entity vulnerabilit...

Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF

This module exploits an XML external entity vulnerability and a server side request forgery to get unauthenticated code execution on Zimbra Collaboration Suite. The XML external entity vulnerability in the Autodiscover Servlet is used to read a Zimbra configuration file that contains an LDAP...

PT-2019-6447 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite versions 8.6 before patch 13 Zimbra Collaboration Suite versions 8.7.x before 8.7.11 patch 10 Zimbra Collaboration Suite versions 8.8.x before 8.8.10 patch 7 Zimbra Collaboration Suite versions 8.8.x before 8.8.11...