Description

A component of Zimbra Collaboration Suite allows an unauthenticated attacker to send an HTTP request to a remote host. An attacker may use this feature to perform SSRF (Server-side request forgery) attacks on the server.

Remediation

Upgrade to the latest version of Zimbra Collaboration Suite

References

Zimbra Collaboration 8.8.15 Patch 7

zimbra SSRF vulnerability

Related Vulnerabilities

SAP NW DI SSRF vulnerability (CVE-2021-33690)

Apache Solr SSRF CVE-2017-3164

Flex BlazeDS AMF Deserialization RCE

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Server-Side Request Forgery (2.1.6)

Adobe Commerce/Magento "CosmicSting" XXE (CVE-2024-34102)

Severity

High

Classification

CVE-2020-7796 CWE-918 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Acumonitor SSRF