Back to search
CVE-2022-37042
Published: Aug 11, 2022
Modified: Oct 21, 2025
PUBLISHED
Description
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
x_refsource_MISC
https://wiki.zimbra.com/wiki/Security_Center
x_refsource_MISC
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now