← Back

CVE-2022-27925

nvd nist
Published: Apr 21, 2022Modified: Oct 31, 2025CISA KEV

JSON object

Loading...
7.2
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.2 / Impact: 5.9
Source: NVD

Description

Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.

Affected (55)

Synacor
1 product
Zimbra Collaboration Suite
Configuration A
55 vulnerable
Vulnerable SoftwareAffected Versions
Synacor
Zimbra Collaboration Suite
Version 8.8.15
Zimbra Collaboration Suite
Version 8.8.15 p10
Zimbra Collaboration Suite
Version 8.8.15 p11
Zimbra Collaboration Suite
Version 8.8.15 p12
Zimbra Collaboration Suite
Version 8.8.15 p13
Zimbra Collaboration Suite
Version 8.8.15 p14
Zimbra Collaboration Suite
Version 8.8.15 p15
Zimbra Collaboration Suite
Version 8.8.15 p16
Zimbra Collaboration Suite
Version 8.8.15 p17
Zimbra Collaboration Suite
Version 8.8.15 p18
Zimbra Collaboration Suite
Version 8.8.15 p19
Zimbra Collaboration Suite
Version 8.8.15 p1
Zimbra Collaboration Suite
Version 8.8.15 p20
Zimbra Collaboration Suite
Version 8.8.15 p21
Zimbra Collaboration Suite
Version 8.8.15 p22
Zimbra Collaboration Suite
Version 8.8.15 p23
Zimbra Collaboration Suite
Version 8.8.15 p24
Zimbra Collaboration Suite
Version 8.8.15 p25
Zimbra Collaboration Suite
Version 8.8.15 p26
Zimbra Collaboration Suite
Version 8.8.15 p27
Zimbra Collaboration Suite
Version 8.8.15 p28
Zimbra Collaboration Suite
Version 8.8.15 p29
Zimbra Collaboration Suite
Version 8.8.15 p2
Zimbra Collaboration Suite
Version 8.8.15 p30
Zimbra Collaboration Suite
Version 8.8.15 p3
Zimbra Collaboration Suite
Version 8.8.15 p4
Zimbra Collaboration Suite
Version 8.8.15 p5
Zimbra Collaboration Suite
Version 8.8.15 p6
Zimbra Collaboration Suite
Version 8.8.15 p7
Zimbra Collaboration Suite
Version 8.8.15 p8
Zimbra Collaboration Suite
Version 8.8.15 p9
Zimbra Collaboration Suite
Version 9.0.0
Zimbra Collaboration Suite
Version 9.0.0 p10
Zimbra Collaboration Suite
Version 9.0.0 p11
Zimbra Collaboration Suite
Version 9.0.0 p12
Zimbra Collaboration Suite
Version 9.0.0 p13
Zimbra Collaboration Suite
Version 9.0.0 p14
Zimbra Collaboration Suite
Version 9.0.0 p15
Zimbra Collaboration Suite
Version 9.0.0 p16
Zimbra Collaboration Suite
Version 9.0.0 p17
Zimbra Collaboration Suite
Version 9.0.0 p18
Zimbra Collaboration Suite
Version 9.0.0 p19
Zimbra Collaboration Suite
Version 9.0.0 p1
Zimbra Collaboration Suite
Version 9.0.0 p20
Zimbra Collaboration Suite
Version 9.0.0 p21
Zimbra Collaboration Suite
Version 9.0.0 p22
Zimbra Collaboration Suite
Version 9.0.0 p23
Zimbra Collaboration Suite
Version 9.0.0 p2
Zimbra Collaboration Suite
Version 9.0.0 p3
Zimbra Collaboration Suite
Version 9.0.0 p4
Zimbra Collaboration Suite
Version 9.0.0 p5
Zimbra Collaboration Suite
Version 9.0.0 p6
Zimbra Collaboration Suite
Version 9.0.0 p7
Zimbra Collaboration Suite
Version 9.0.0 p8
Zimbra Collaboration Suite
Version 9.0.0 p9

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (9)

Source: cve@mitre.org
ExploitThird Party AdvisoryVDB Entry
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Release NotesVendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
US Government Resource

Timeline

No history available yet.