CVE-2024-27442 - Vulnerability Details

Vendors	Products
Zimbra	Collaboration

Link	Providers
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes
https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes

Type	Values Removed	Values Added
Weaknesses		CWE-755
CPEs		cpe:2.3:a:zimbra:collaboration:::::::: cpe:2.3:a:zimbra:collaboration:9.0.0:-:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p0:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p10:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p11:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p12:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p13:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p14:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p15:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p16:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p19:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p1:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p20:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p21:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p23:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p24:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p25:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p26:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p27:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p2:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p30:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p31:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p32:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p33:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p34:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p35:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p36:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p37:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p38:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p3:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p4:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p5:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p6:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p7:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p8:::::: cpe:2.3:a:zimbra:collaboration:9.0.0:p9::::::

Type	Values Removed	Values Added
First Time appeared		Zimbra Zimbra collaboration
Weaknesses		CWE-269
CPEs		cpe:2.3:a:zimbra:collaboration:10.0:::::::* cpe:2.3:a:zimbra:collaboration:9.0:::::::*
Vendors & Products		Zimbra Zimbra collaboration
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation.
References		https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes

Show plain JSON

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-27442", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-13T14:44:13.521Z", "dateReserved": "2024-02-26T00:00:00", "datePublished": "2024-08-12T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-08-12T14:58:03.586556"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-269", "lang": "en", "description": "CWE-269 Improper Privilege Management"}]}], "affected": [{"vendor": "zimbra", "product": "collaboration", "cpes": ["cpe:2.3:a:zimbra:collaboration:9.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "9.0", "status": "affected"}]}, {"vendor": "zimbra", "product": "collaboration", "cpes": ["cpe:2.3:a:zimbra:collaboration:10.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "10.0", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-08-13T14:18:27.711384Z", "id": "CVE-2024-27442", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T14:44:13.521Z"}}]}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2024-27442 (string)

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

assignerShortName : mitre (string)

dateUpdated : 2024-08-13T14:44:13.521Z (string)

dateReserved : 2024-02-26T00:00:00 (string)

datePublished : 2024-08-12T00:00:00 (string)

}

containers : { »

cna : { »

providerMetadata : { »

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

dateUpdated : 2024-08-12T14:58:03.586556 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation. (string)

}

]

affected : [ »

0 : { »

vendor : n/a (string)

product : n/a (string)

versions : [ »

0 : { »

version : n/a (string)

status : affected (string)

}

]

}

]

references : [ »

0 : { »

url : https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes (string)

}

1 : { »

url : https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : text (string)

lang : en (string)

description : n/a (string)

}

]

}

]

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-269 (string)

lang : en (string)

description : CWE-269 Improper Privilege Management (string)

}

]

}

]

affected : [ »

0 : { »

vendor : zimbra (string)

product : collaboration (string)

cpes : [ »

0 : cpe:2.3:a:zimbra:collaboration:9.0:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 9.0 (string)

status : affected (string)

}

]

}

1 : { »

vendor : zimbra (string)

product : collaboration (string)

cpes : [ »

0 : cpe:2.3:a:zimbra:collaboration:10.0:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 10.0 (string)

status : affected (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.8 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-13T14:18:27.711384Z (string)

id : CVE-2024-27442 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-13T14:44:13.521Z (string)

}

]

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-27442", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-08-13T14:18:27.711384Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:zimbra:collaboration:9.0:*:*:*:*:*:*:*"], "vendor": "zimbra", "product": "collaboration", "versions": [{"status": "affected", "version": "9.0"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:zimbra:collaboration:10.0:*:*:*:*:*:*:*"], "vendor": "zimbra", "product": "collaboration", "versions": [{"status": "affected", "version": "10.0"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-13T14:44:04.426Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-08-12T14:58:03.586556"}}}, "cveMetadata": {"cveId": "CVE-2024-27442", "state": "PUBLISHED", "dateUpdated": "2024-08-13T14:44:13.521Z", "dateReserved": "2024-02-26T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-08-12T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.8 (number)

attackVector : LOCAL (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : LOW (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-27442 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-13T14:18:27.711384Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:zimbra:collaboration:9.0:*:*:*:*:*:*:* (string)

]

vendor : zimbra (string)

product : collaboration (string)

versions : [ »

0 : { »

status : affected (string)

version : 9.0 (string)

}

]

defaultStatus : unknown (string)

}

1 : { »

cpes : [ »

0 : cpe:2.3:a:zimbra:collaboration:10.0:*:*:*:*:*:*:* (string)

]

vendor : zimbra (string)

product : collaboration (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.0 (string)

}

]

defaultStatus : unknown (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-269 (string)

description : CWE-269 Improper Privilege Management (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-13T14:44:04.426Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : n/a (string)

product : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

references : [ »

0 : { »

url : https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes (string)

}

1 : { »

url : https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : n/a (string)

}

]

}

]

providerMetadata : { »

orgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

shortName : mitre (string)

dateUpdated : 2024-08-12T14:58:03.586556 (string)

}

cveMetadata : { »

cveId : CVE-2024-27442 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-13T14:44:13.521Z (string)

dateReserved : 2024-02-26T00:00:00 (string)

assignerOrgId : 8254265b-2729-46b6-b9e3-3dfca2d5bfca (string)

datePublished : 2024-08-12T00:00:00 (string)

assignerShortName : mitre (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CE0029A-44EA-4774-879D-5FA2D35F09BD", "versionEndExcluding": "10.0.7", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "685D9652-2934-4C13-8B36-40582C79BFC1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*", "matchCriteriaId": "5E4DF01A-1AA9-47E8-82FD-65A02ECA1376", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*", "matchCriteriaId": "BDE59185-B917-4A81-8DE4-C65A079F52FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*", "matchCriteriaId": "BA3ED95F-95F2-4676-8EAF-B4B9EB64B260", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*", "matchCriteriaId": "4BB93336-CC3C-4B7F-B194-7DED036ABBAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*", "matchCriteriaId": "876F1675-F65C-4E86-ADBD-36EB8D8A997D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*", "matchCriteriaId": "2306F526-9C56-4A57-AA9B-02F2D6058C97", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*", "matchCriteriaId": "F9EA2A61-67AA-4B7E-BC6E-80EB1363EF85", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*", "matchCriteriaId": "C77A35B7-96F6-43A7-A747-C6AEEDE961E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*", "matchCriteriaId": "DC35882B-E709-42D8-8800-F1B734CEAFC3", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*", "matchCriteriaId": "B7A47276-F241-4A68-9458-E1481EBDC5E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*", "matchCriteriaId": "12D0D469-6C9B-4B66-9581-DC319773238A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*", "matchCriteriaId": "40629BEB-DF4B-4FB8-8D3D-7BAC43C90766", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*", "matchCriteriaId": "9503131F-CC23-4545-AE9C-9714B287CC25", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*", "matchCriteriaId": "B4CE2D12-AD31-4FED-AD0F-ADF64E92E1B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*", "matchCriteriaId": "8113A4E3-AA96-4382-815D-6FD88BA42EC5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*", "matchCriteriaId": "DC8C28E0-6C51-41EE-A7B2-DB185D1D8FD0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*", "matchCriteriaId": "BC19F11D-23D9-429D-A957-D67F23A40A01", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*", "matchCriteriaId": "AAFA2EE7-C965-4F27-8CAE-E607A9F202AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*", "matchCriteriaId": "1D09DCF6-1C8F-4CA1-B7D4-AFDD4EB35771", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*", "matchCriteriaId": "C52705E6-2C6B-47BC-A0CD-F6AAE0BFC302", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*", "matchCriteriaId": "FD1DCE2B-D944-43AE-AD0E-9282DE6D618F", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*", "matchCriteriaId": "2079B9F8-128B-487D-A965-E8B37FDF6304", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*", "matchCriteriaId": "9679FD62-815E-47A8-8552-D28CE48B82B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*", "matchCriteriaId": "D659AE6A-591E-4D5B-9781-9648250F5576", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*", "matchCriteriaId": "E4054E3E-561C-4B1C-A615-3CCE5CB69D77", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*", "matchCriteriaId": "4FA0E9C4-25E4-4CD6-B88A-02B413385866", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*", "matchCriteriaId": "5D6F7CA3-C36A-466C-8FAD-D0B3CEF01F0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*", "matchCriteriaId": "9684AC81-B557-4292-8402-AE55CB2E613C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*", "matchCriteriaId": "32A352C4-0E9C-436F-ADA7-D93492A18037", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*", "matchCriteriaId": "33F50D8C-7027-4A8D-8E95-98C224283772", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*", "matchCriteriaId": "82000BA4-1781-4312-A7BD-92EC94D137AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*", "matchCriteriaId": "4B52D301-2559-457A-8FFB-F0915299355A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*", "matchCriteriaId": "7215AE2C-8A33-4AB9-88D5-7C8CD11E806C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*", "matchCriteriaId": "8D859F77-8E39-4D46-BC90-C5C1D805A666", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*", "matchCriteriaId": "CDC810C7-45DA-4BDF-9138-2D3B2750243E", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*", "matchCriteriaId": "E09D95A4-764D-4E0B-8605-1D94FD548AB2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en Zimbra Collaboration (ZCS) 9.0 y 10.0. El binario zmmailboxdmgr, un componente de ZCS, est\u00e1 manipulado para que lo ejecute el usuario de zimbra con privilegios de root para operaciones espec\u00edficas del buz\u00f3n. Sin embargo, un atacante puede escalar privilegios del usuario de zimbra al root debido al manejo inadecuado de los argumentos de entrada. Un atacante puede ejecutar comandos arbitrarios con privilegios elevados, lo que lleva a una escalada de privilegios locales."}], "id": "CVE-2024-27442", "lastModified": "2024-08-13T17:30:36.833", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-08-12T15:15:20.193", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-755"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-269"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 4CE0029A-44EA-4774-879D-5FA2D35F09BD (string)

versionEndExcluding : 10.0.7 (string)

versionStartIncluding : 10.0.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:* (string)

matchCriteriaId : 685D9652-2934-4C13-8B36-40582C79BFC1 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:* (string)

matchCriteriaId : 5E4DF01A-1AA9-47E8-82FD-65A02ECA1376 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:* (string)

matchCriteriaId : BDE59185-B917-4A81-8DE4-C65A079F52FE (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:* (string)

matchCriteriaId : BA3ED95F-95F2-4676-8EAF-B4B9EB64B260 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:* (string)

matchCriteriaId : 4BB93336-CC3C-4B7F-B194-7DED036ABBAF (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:* (string)

matchCriteriaId : 876F1675-F65C-4E86-ADBD-36EB8D8A997D (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:* (string)

matchCriteriaId : 2306F526-9C56-4A57-AA9B-02F2D6058C97 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:* (string)

matchCriteriaId : F9EA2A61-67AA-4B7E-BC6E-80EB1363EF85 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:* (string)

matchCriteriaId : C77A35B7-96F6-43A7-A747-C6AEEDE961E1 (string)

vulnerable : true (boolean)

}

10 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:* (string)

matchCriteriaId : DC35882B-E709-42D8-8800-F1B734CEAFC3 (string)

vulnerable : true (boolean)

}

11 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:* (string)

matchCriteriaId : B7A47276-F241-4A68-9458-E1481EBDC5E6 (string)

vulnerable : true (boolean)

}

12 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:* (string)

matchCriteriaId : 12D0D469-6C9B-4B66-9581-DC319773238A (string)

vulnerable : true (boolean)

}

13 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:* (string)

matchCriteriaId : 40629BEB-DF4B-4FB8-8D3D-7BAC43C90766 (string)

vulnerable : true (boolean)

}

14 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:* (string)

matchCriteriaId : 9503131F-CC23-4545-AE9C-9714B287CC25 (string)

vulnerable : true (boolean)

}

15 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:* (string)

matchCriteriaId : B4CE2D12-AD31-4FED-AD0F-ADF64E92E1B1 (string)

vulnerable : true (boolean)

}

16 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:* (string)

matchCriteriaId : 8113A4E3-AA96-4382-815D-6FD88BA42EC5 (string)

vulnerable : true (boolean)

}

17 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:* (string)

matchCriteriaId : DC8C28E0-6C51-41EE-A7B2-DB185D1D8FD0 (string)

vulnerable : true (boolean)

}

18 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:* (string)

matchCriteriaId : BC19F11D-23D9-429D-A957-D67F23A40A01 (string)

vulnerable : true (boolean)

}

19 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:* (string)

matchCriteriaId : AAFA2EE7-C965-4F27-8CAE-E607A9F202AD (string)

vulnerable : true (boolean)

}

20 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:* (string)

matchCriteriaId : 1D09DCF6-1C8F-4CA1-B7D4-AFDD4EB35771 (string)

vulnerable : true (boolean)

}

21 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:* (string)

matchCriteriaId : C52705E6-2C6B-47BC-A0CD-F6AAE0BFC302 (string)

vulnerable : true (boolean)

}

22 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:* (string)

matchCriteriaId : FD1DCE2B-D944-43AE-AD0E-9282DE6D618F (string)

vulnerable : true (boolean)

}

23 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:* (string)

matchCriteriaId : 2079B9F8-128B-487D-A965-E8B37FDF6304 (string)

vulnerable : true (boolean)

}

24 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:* (string)

matchCriteriaId : 9679FD62-815E-47A8-8552-D28CE48B82B2 (string)

vulnerable : true (boolean)

}

25 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:* (string)

matchCriteriaId : D659AE6A-591E-4D5B-9781-9648250F5576 (string)

vulnerable : true (boolean)

}

26 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:* (string)

matchCriteriaId : E4054E3E-561C-4B1C-A615-3CCE5CB69D77 (string)

vulnerable : true (boolean)

}

27 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:* (string)

matchCriteriaId : 4FA0E9C4-25E4-4CD6-B88A-02B413385866 (string)

vulnerable : true (boolean)

}

28 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:* (string)

matchCriteriaId : 5D6F7CA3-C36A-466C-8FAD-D0B3CEF01F0E (string)

vulnerable : true (boolean)

}

29 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:* (string)

matchCriteriaId : 9684AC81-B557-4292-8402-AE55CB2E613C (string)

vulnerable : true (boolean)

}

30 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:* (string)

matchCriteriaId : 32A352C4-0E9C-436F-ADA7-D93492A18037 (string)

vulnerable : true (boolean)

}

31 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:* (string)

matchCriteriaId : 33F50D8C-7027-4A8D-8E95-98C224283772 (string)

vulnerable : true (boolean)

}

32 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:* (string)

matchCriteriaId : 82000BA4-1781-4312-A7BD-92EC94D137AE (string)

vulnerable : true (boolean)

}

33 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:* (string)

matchCriteriaId : 4B52D301-2559-457A-8FFB-F0915299355A (string)

vulnerable : true (boolean)

}

34 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:* (string)

matchCriteriaId : 7215AE2C-8A33-4AB9-88D5-7C8CD11E806C (string)

vulnerable : true (boolean)

}

35 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:* (string)

matchCriteriaId : 8D859F77-8E39-4D46-BC90-C5C1D805A666 (string)

vulnerable : true (boolean)

}

36 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:* (string)

matchCriteriaId : CDC810C7-45DA-4BDF-9138-2D3B2750243E (string)

vulnerable : true (boolean)

}

37 : { »

criteria : cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:* (string)

matchCriteriaId : E09D95A4-764D-4E0B-8605-1D94FD548AB2 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation. (string)

}

1 : { »

lang : es (string)

value : Se descubrió un problema en Zimbra Collaboration (ZCS) 9.0 y 10.0. El binario zmmailboxdmgr, un componente de ZCS, está manipulado para que lo ejecute el usuario de zimbra con privilegios de root para operaciones específicas del buzón. Sin embargo, un atacante puede escalar privilegios del usuario de zimbra al root debido al manejo inadecuado de los argumentos de entrada. Un atacante puede ejecutar comandos arbitrarios con privilegios elevados, lo que lleva a una escalada de privilegios locales. (string)

}

]

id : CVE-2024-27442 (string)

lastModified : 2024-08-13T17:30:36.833 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.9 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2024-08-12T15:15:20.193 (string)

references : [ »

0 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Release Notes (string)

]

url : https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes (string)

}

1 : { »

source : cve@mitre.org (string)

tags : [ »

0 : Release Notes (string)

]

url : https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes (string)

}

]

sourceIdentifier : cve@mitre.org (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-755 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-269 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object