7.5

CVE-2024-33535

An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without authentication, potentially leading to unauthorized access to sensitive information. The vulnerability is limited to files within a specific directory.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zimbra ≫ Collaboration Version >= 10.0.0 < 10.0.8
Zimbra ≫ Collaboration Version 9.0.0 Update -
Zimbra ≫ Collaboration Version 9.0.0 Update p0
Zimbra ≫ Collaboration Version 9.0.0 Update p1
Zimbra ≫ Collaboration Version 9.0.0 Update p10
Zimbra ≫ Collaboration Version 9.0.0 Update p11
Zimbra ≫ Collaboration Version 9.0.0 Update p12
Zimbra ≫ Collaboration Version 9.0.0 Update p13
Zimbra ≫ Collaboration Version 9.0.0 Update p14
Zimbra ≫ Collaboration Version 9.0.0 Update p15
Zimbra ≫ Collaboration Version 9.0.0 Update p16
Zimbra ≫ Collaboration Version 9.0.0 Update p19
Zimbra ≫ Collaboration Version 9.0.0 Update p2
Zimbra ≫ Collaboration Version 9.0.0 Update p20
Zimbra ≫ Collaboration Version 9.0.0 Update p21
Zimbra ≫ Collaboration Version 9.0.0 Update p23
Zimbra ≫ Collaboration Version 9.0.0 Update p24
Zimbra ≫ Collaboration Version 9.0.0 Update p24.1
Zimbra ≫ Collaboration Version 9.0.0 Update p25
Zimbra ≫ Collaboration Version 9.0.0 Update p26
Zimbra ≫ Collaboration Version 9.0.0 Update p27
Zimbra ≫ Collaboration Version 9.0.0 Update p3
Zimbra ≫ Collaboration Version 9.0.0 Update p30
Zimbra ≫ Collaboration Version 9.0.0 Update p31
Zimbra ≫ Collaboration Version 9.0.0 Update p32
Zimbra ≫ Collaboration Version 9.0.0 Update p33
Zimbra ≫ Collaboration Version 9.0.0 Update p34
Zimbra ≫ Collaboration Version 9.0.0 Update p35
Zimbra ≫ Collaboration Version 9.0.0 Update p36
Zimbra ≫ Collaboration Version 9.0.0 Update p37
Zimbra ≫ Collaboration Version 9.0.0 Update p38
Zimbra ≫ Collaboration Version 9.0.0 Update p39
Zimbra ≫ Collaboration Version 9.0.0 Update p4
Zimbra ≫ Collaboration Version 9.0.0 Update p5
Zimbra ≫ Collaboration Version 9.0.0 Update p6
Zimbra ≫ Collaboration Version 9.0.0 Update p7
Zimbra ≫ Collaboration Version 9.0.0 Update p7.1
Zimbra ≫ Collaboration Version 9.0.0 Update p8
Zimbra ≫ Collaboration Version 9.0.0 Update p9
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.55% 0.417
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA-ADP 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.8#Security_Fixes
Release Notes
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P40#Security_Fixes
Release Notes