CVE-2019-9621

Published: Apr 30, 2019

Modified: Oct 21, 2025

PUBLISHED

Description

Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

x_refsource_CONFIRM

https://wiki.zimbra.com/wiki/Security_Center

x_refsource_MISC

https://bugzilla.zimbra.com/show_bug.cgi?id=109127

x_refsource_MISC

http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce

x_refsource_MISC

http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html

x_refsource_MISC

46693

exploit

x_refsource_EXPLOIT-DB

https://blog.zimbra.com/2019/03/9826/

x_refsource_MISC

https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html

x_refsource_MISC

http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2019-9621

Description

Affected Products

References