CVE-2022-3569

Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra' user can effectively coerce postfix into running arbitrary commands as 'root'.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
rapid7CNA
---
---
CVEADP
---
---
CISA-ADPADP
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 83%
VendorProductVersion
synacorzimbra_collaboration_suite
𝑥
≤ 9.0.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/169430/Zimbra-Privilege-Escalation.html
https://github.com/rapid7/metasploit-framework/pull/17141
https://twitter.com/ldsopreload/status/1580539318879547392
http://packetstormsecurity.com/files/169430/Zimbra-Privilege-Escalation.html
https://github.com/rapid7/metasploit-framework/pull/17141
https://twitter.com/ldsopreload/status/1580539318879547392