CVE-2019-9670

nvd nist nuclei

Published: May 29, 2019Modified: Jun 17, 2026CISA KEV

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

Affected (11)

Products: Synacor: Zimbra Collaboration Suite

1 product

Zimbra Collaboration Suite

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Synacor Zimbra Collaboration Suite	From 8.7.0 to 8.7.11
Synacor Zimbra Collaboration Suite	Version 8.7.11
Synacor Zimbra Collaboration Suite	Version 8.7.11 p1
Synacor Zimbra Collaboration Suite	Version 8.7.11 p2
Synacor Zimbra Collaboration Suite	Version 8.7.11 p3
Synacor Zimbra Collaboration Suite	Version 8.7.11 p4
Synacor Zimbra Collaboration Suite	Version 8.7.11 p5
Synacor Zimbra Collaboration Suite	Version 8.7.11 p6
Synacor Zimbra Collaboration Suite	Version 8.7.11 p7
Synacor Zimbra Collaboration Suite	Version 8.7.11 p8
Synacor Zimbra Collaboration Suite	Version 8.7.11 p9

Related CWEs

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (13)

http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.zimbra.com/show_bug.cgi?id=109129

Source: cve@mitre.org

Broken LinkIssue TrackingPatchThird Party Advisory

https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/

Source: cve@mitre.org

ExploitThird Party Advisory

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Source: cve@mitre.org

Vendor Advisory

https://www.exploit-db.com/exploits/46693/

Source: cve@mitre.org

ExploitThird Party AdvisoryVDB Entry

http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.zimbra.com/show_bug.cgi?id=109129

Source: af854a3a-2127-422b-91ae-364da2661108

Broken LinkIssue TrackingPatchThird Party Advisory

https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.exploit-db.com/exploits/46693/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party AdvisoryVDB Entry

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9670

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.