CVE-2013-7091

Published: Dec 13, 2013Modified: Apr 29, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

Directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the skin parameter. NOTE: this can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API.

Affected (16)

Products: Synacor: Zimbra Collaboration Suite

Synacor

1 product

Zimbra Collaboration Suite

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Synacor Zimbra Collaboration Suite	Version 6.0.0
Synacor Zimbra Collaboration Suite	Version 6.0.10
Synacor Zimbra Collaboration Suite	Version 6.0.12
Synacor Zimbra Collaboration Suite	Version 6.0.13
Synacor Zimbra Collaboration Suite	Version 6.0.14
Synacor Zimbra Collaboration Suite	Version 6.0.15
Synacor Zimbra Collaboration Suite	Version 6.0.16
Synacor Zimbra Collaboration Suite	Version 6.0.1
Synacor Zimbra Collaboration Suite	Version 6.0.2
Synacor Zimbra Collaboration Suite	Version 6.0.3
Synacor Zimbra Collaboration Suite	Version 6.0.4
Synacor Zimbra Collaboration Suite	Version 6.0.5
Synacor Zimbra Collaboration Suite	Version 6.0.6
Synacor Zimbra Collaboration Suite	Version 6.0.7
Synacor Zimbra Collaboration Suite	Version 6.0.8
Synacor Zimbra Collaboration Suite	Version 6.0.9