CVE-2024-45519 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	10 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
mitre	CNA	10 CRITICAL	NETWORK	LOW	NONE	CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N
CISA-ADP	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 99%

Vendor	Product	Version
zimbra	collaboration	𝑥 < 8.8.15
zimbra	collaboration	10.0.0 ≤ 𝑥 < 10.0.9
zimbra	collaboration	8.8.15
zimbra	collaboration	8.8.15:p1
zimbra	collaboration	8.8.15:p10
zimbra	collaboration	8.8.15:p11
zimbra	collaboration	8.8.15:p12
zimbra	collaboration	8.8.15:p13
zimbra	collaboration	8.8.15:p14
zimbra	collaboration	8.8.15:p15
zimbra	collaboration	8.8.15:p16
zimbra	collaboration	8.8.15:p17
zimbra	collaboration	8.8.15:p18
zimbra	collaboration	8.8.15:p19
zimbra	collaboration	8.8.15:p2
zimbra	collaboration	8.8.15:p20
zimbra	collaboration	8.8.15:p21
zimbra	collaboration	8.8.15:p22
zimbra	collaboration	8.8.15:p23
zimbra	collaboration	8.8.15:p24
zimbra	collaboration	8.8.15:p25
zimbra	collaboration	8.8.15:p26
zimbra	collaboration	8.8.15:p27
zimbra	collaboration	8.8.15:p28
zimbra	collaboration	8.8.15:p29
zimbra	collaboration	8.8.15:p3
zimbra	collaboration	8.8.15:p30
zimbra	collaboration	8.8.15:p31
zimbra	collaboration	8.8.15:p32
zimbra	collaboration	8.8.15:p33
zimbra	collaboration	8.8.15:p34
zimbra	collaboration	8.8.15:p35
zimbra	collaboration	8.8.15:p37
zimbra	collaboration	8.8.15:p4
zimbra	collaboration	8.8.15:p40
zimbra	collaboration	8.8.15:p41
zimbra	collaboration	8.8.15:p42
zimbra	collaboration	8.8.15:p43
zimbra	collaboration	8.8.15:p44
zimbra	collaboration	8.8.15:p45
zimbra	collaboration	8.8.15:p5
zimbra	collaboration	8.8.15:p6
zimbra	collaboration	8.8.15:p7
zimbra	collaboration	8.8.15:p8
zimbra	collaboration	8.8.15:p9
zimbra	collaboration	9.0.0
zimbra	collaboration	9.0.0:p0
zimbra	collaboration	9.0.0:p1
zimbra	collaboration	9.0.0:p10
zimbra	collaboration	9.0.0:p11
zimbra	collaboration	9.0.0:p12
zimbra	collaboration	9.0.0:p13
zimbra	collaboration	9.0.0:p14
zimbra	collaboration	9.0.0:p15
zimbra	collaboration	9.0.0:p16
zimbra	collaboration	9.0.0:p19
zimbra	collaboration	9.0.0:p2
zimbra	collaboration	9.0.0:p20
zimbra	collaboration	9.0.0:p21
zimbra	collaboration	9.0.0:p23
zimbra	collaboration	9.0.0:p24
zimbra	collaboration	9.0.0:p24.1
zimbra	collaboration	9.0.0:p25
zimbra	collaboration	9.0.0:p26
zimbra	collaboration	9.0.0:p27
zimbra	collaboration	9.0.0:p3
zimbra	collaboration	9.0.0:p33
zimbra	collaboration	9.0.0:p34
zimbra	collaboration	9.0.0:p35
zimbra	collaboration	9.0.0:p36
zimbra	collaboration	9.0.0:p37
zimbra	collaboration	9.0.0:p38
zimbra	collaboration	9.0.0:p39
zimbra	collaboration	9.0.0:p4
zimbra	collaboration	9.0.0:p40
zimbra	collaboration	9.0.0:p5
zimbra	collaboration	9.0.0:p6
zimbra	collaboration	9.0.0:p7
zimbra	collaboration	9.0.0:p7.1
zimbra	collaboration	9.0.0:p8
zimbra	collaboration	9.0.0:p9
zimbra	collaboration	10.1.0

𝑥

= Vulnerable software versions

Known Exploits!

https://blog.projectdiscovery.io/zimbra-remote-code-execution/

Common Weakness Enumeration

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References

https://wiki.zimbra.com/wiki/Security_Center

https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes

https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes

https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes

https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes

https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy

https://blog.projectdiscovery.io/zimbra-remote-code-execution/