According to its self-reported version number, Zimbra Collaboration Server is affected by a multiple vulnerabilities, including the following:

  - An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS)     8.8.15 and 9.0. The value of the X-Forwarded-Host header overwrites the value of the Host header in     proxied requests. The value of X-Forwarded-Host header is not checked against the whitelist of hosts that     ZCS is allowed to proxy to (the zimbraProxyAllowedDomains setting). (CVE-2022-37041)

  - Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive     and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can     upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this     issue exists because of an incomplete fix for CVE-2022-27925. (CVE-2022-37042)

  - An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When     using preauth, CSRF tokens are not checked on some POST endpoints. Thus, when an authenticated user views     an attacker-controlled page, a request will be sent to the application that appears to be intended. The     CSRF token is omitted from the request, but the request still succeeds. (CVE-2022-37043)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Zimbra Collaboration Server 8.8.x < 8.8.15 Patch 33 / 9.0.0 < 9.0.0 Patch 26 Multiple Vulnerabilities

critical Nessus Plugin ID 164341

Version 1.4