CVE-2024-54663

Published: Dec 19, 2024Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue was discovered in the Webmail Classic UI in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Local File Inclusion (LFI) vulnerability exists in the /h/rest endpoint, allowing authenticated remote attackers to include and access sensitive files in the WebRoot directory. Exploitation requires a valid auth token and involves crafting a malicious request targeting specific file paths.

Affected (2)

Products: Synacor: Zimbra Collaboration Suite

1 product

Zimbra Collaboration Suite

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Synacor Zimbra Collaboration Suite	From 10.1.0 to 10.1.3
Synacor Zimbra Collaboration Suite	From 9.0.0 to 10.0.11

Related CWEs

Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

References (2)

https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.11#Security_Fixes

Source: cve@mitre.org

Release Notes

https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.3#Security_Fixes

Source: cve@mitre.org

Release Notes

Timeline

No history available yet.