CVE-2022-37042 — Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

Known ransomware use CISA KEV listed Added August 11, 2022 Remediate by September 1, 2022

Description

Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.

Required action

Apply updates per vendor instructions.

Notes

https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/; https://nvd.nist.gov/vuln/detail/CVE-2022-37042

Need help remediating this vulnerability?

Our team helps organizations patch, mitigate, and respond to CISA KEV advisories fast.

Talk to an engineer