{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-45518", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-10-22T18:10:41.843Z", "dateReserved": "2024-09-01T00:00:00", "datePublished": "2024-10-22T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-22T17:10:15.921452"}, "descriptions": [{"lang": "en", "value": "An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE)."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"}, {"url": "https://wiki.zimbra.com/wiki/Security_Center"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-918", "lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "affected": [{"vendor": "zimbra", "product": "collaboration", "cpes": ["cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "10.1.0", "status": "affected", "lessThan": "10.1.1", "versionType": "custom"}, {"version": "10.0.0", "status": "affected", "lessThan": "10.0.9", "versionType": "custom"}, {"version": "9.0.0", "status": "affected", "lessThan": "patch41", "versionType": "custom"}, {"version": "8.8.15", "status": "affected", "lessThan": "patch46", "versionType": "custom"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-10-22T18:07:12.455265Z", "id": "CVE-2024-45518", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T18:10:41.843Z"}}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-45518", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-22T18:07:12.455265Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*"], "vendor": "zimbra", "product": "collaboration", "versions": [{"status": "affected", "version": "10.1.0", "lessThan": "10.1.1", "versionType": "custom"}, {"status": "affected", "version": "10.0.0", "lessThan": "10.0.9", "versionType": "custom"}, {"status": "affected", "version": "9.0.0", "lessThan": "patch41", "versionType": "custom"}, {"status": "affected", "version": "8.8.15", "lessThan": "patch46", "versionType": "custom"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-22T18:10:33.834Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"}, {"url": "https://wiki.zimbra.com/wiki/Security_Center"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes"}, {"url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE)."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-10-22T17:10:15.921452"}}}, "cveMetadata": {"cveId": "CVE-2024-45518", "state": "PUBLISHED", "dateUpdated": "2024-10-22T18:10:41.843Z", "dateReserved": "2024-09-01T00:00:00", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-10-22T00:00:00", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*", "matchCriteriaId": "18D6B3CE-07F4-45F9-A5C8-3CA0B1395039", "versionEndExcluding": "10.0.9", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*", "matchCriteriaId": "1B17C1A7-0F0A-4E7C-8C0C-0BBB0BF66C82", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p1:*:*:*:*:*:*", "matchCriteriaId": "BA48C450-201C-4398-AB65-EF6F95FB0380", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p10:*:*:*:*:*:*", "matchCriteriaId": "5F759114-CF2D-48BF-8D09-EBE8D1ED1949", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:*", "matchCriteriaId": "AE8BD950-24A2-4AFF-B7EE-6EE115BD75D6", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p12:*:*:*:*:*:*", "matchCriteriaId": "C43634F5-2946-44D2-8A50-B717374A8126", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p13:*:*:*:*:*:*", "matchCriteriaId": "20315895-5410-4B88-B2D9-E9C5D79A64DF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p14:*:*:*:*:*:*", "matchCriteriaId": "BF405091-A832-4945-87EC-AA525F37DF91", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p15:*:*:*:*:*:*", "matchCriteriaId": "C9B6FFA8-CFD2-47C6-9475-79210CB9AA84", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p16:*:*:*:*:*:*", "matchCriteriaId": "964CA714-937C-4FC0-A1E9-07F846C786BD", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p17:*:*:*:*:*:*", "matchCriteriaId": "DAF8F155-1406-46ED-A81F-BCC4CE525F43", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p18:*:*:*:*:*:*", "matchCriteriaId": "56A8F56B-3457-4C19-B213-3B04FEE8D7A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p19:*:*:*:*:*:*", "matchCriteriaId": "B4F8D255-3F91-45FF-9133-4023BA688F9E", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p2:*:*:*:*:*:*", "matchCriteriaId": "37BC4DF5-D111-4295-94FC-AA8929CDF2A1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p20:*:*:*:*:*:*", "matchCriteriaId": "A9D50108-0404-4791-8057-DB1786D311C8", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p21:*:*:*:*:*:*", "matchCriteriaId": "F2A7E53F-8EAC-4DA9-8EAE-117759EFABEF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p22:*:*:*:*:*:*", "matchCriteriaId": "858727DB-AE6F-435D-B8FD-6C94C3400E40", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p23:*:*:*:*:*:*", "matchCriteriaId": "3FA6AC95-288C-4ABA-B2A7-47E4134EDC31", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p24:*:*:*:*:*:*", "matchCriteriaId": "4AA82728-5901-482A-83CF-F883D4B6A8E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p25:*:*:*:*:*:*", "matchCriteriaId": "7E762792-542E-43D0-A95A-E7F48F328A28", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p26:*:*:*:*:*:*", "matchCriteriaId": "6DD4641A-EC23-4B1A-8729-9AECD70390AF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p27:*:*:*:*:*:*", "matchCriteriaId": "E0E3E825-1D1E-4ECD-B306-DD8BDCDD0547", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p28:*:*:*:*:*:*", "matchCriteriaId": "840F98DC-57F1-4054-A6C1-6E7F0340AC2C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p29:*:*:*:*:*:*", "matchCriteriaId": "EE2A1305-68B7-4CB7-837F-4EDE2EBED507", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p3:*:*:*:*:*:*", "matchCriteriaId": "21768A61-7578-4EEC-A23B-FEC10CAA9EDF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p30:*:*:*:*:*:*", "matchCriteriaId": "CA758408-4302-43BC-BDC9-1B70EC5D2FED", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p31:*:*:*:*:*:*", "matchCriteriaId": "822CDEBC-0650-4970-B46F-06F505993086", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p32:*:*:*:*:*:*", "matchCriteriaId": "971B5005-4676-4D93-A7DD-6AFDC8D0BEEB", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p33:*:*:*:*:*:*", "matchCriteriaId": "81BC6A7F-D014-44B3-9361-20DB256D3C8D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p34:*:*:*:*:*:*", "matchCriteriaId": "6A3DC694-4CCC-4E9F-B6E9-891B1DF115C8", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p35:*:*:*:*:*:*", "matchCriteriaId": "3810385E-95E8-491E-8281-394125DB04F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p37:*:*:*:*:*:*", "matchCriteriaId": "C08B5A0A-2935-4FEB-9133-4B35E1AB0CDB", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p4:*:*:*:*:*:*", "matchCriteriaId": "661403E7-1D65-4710-8413-47D74FF65BE4", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p40:*:*:*:*:*:*", "matchCriteriaId": "4CD3AEF8-0667-40B9-BCAA-6C9CA7D9C495", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p41:*:*:*:*:*:*", "matchCriteriaId": "A0F8BB82-32E4-463D-B719-8E5186CAAECC", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p42:*:*:*:*:*:*", "matchCriteriaId": "9605C0CF-E5DF-497A-B298-D64ABCDAF88E", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p43:*:*:*:*:*:*", "matchCriteriaId": "0A77DFFA-CBBF-4F8C-9D8E-68CC115B4D2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p44:*:*:*:*:*:*", "matchCriteriaId": "4E7EBCB8-3042-4BA9-B34A-E1C95F111B38", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p45:*:*:*:*:*:*", "matchCriteriaId": "5DEF465F-35ED-49ED-A86C-AE1C7FF76AFA", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p5:*:*:*:*:*:*", "matchCriteriaId": "0695D2E0-45B3-493C-BA6D-471B90C0ACC5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p6:*:*:*:*:*:*", "matchCriteriaId": "714FAFE6-68AE-4304-B040-48BC46F85A2D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p7:*:*:*:*:*:*", "matchCriteriaId": "73FC2D2D-8BBD-4259-8B35-0D9BFA40567B", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p8:*:*:*:*:*:*", "matchCriteriaId": "AB97E9E6-CC4A-458D-B731-6D51130B942C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:8.8.15:p9:*:*:*:*:*:*", "matchCriteriaId": "BA688C43-846A-4C4A-AEDB-113D967D3D73", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*", "matchCriteriaId": "685D9652-2934-4C13-8B36-40582C79BFC1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*", "matchCriteriaId": "5E4DF01A-1AA9-47E8-82FD-65A02ECA1376", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*", "matchCriteriaId": "BDE59185-B917-4A81-8DE4-C65A079F52FE", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*", "matchCriteriaId": "BA3ED95F-95F2-4676-8EAF-B4B9EB64B260", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*", "matchCriteriaId": "4BB93336-CC3C-4B7F-B194-7DED036ABBAF", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*", "matchCriteriaId": "876F1675-F65C-4E86-ADBD-36EB8D8A997D", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*", "matchCriteriaId": "2306F526-9C56-4A57-AA9B-02F2D6058C97", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*", "matchCriteriaId": "F9EA2A61-67AA-4B7E-BC6E-80EB1363EF85", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*", "matchCriteriaId": "C77A35B7-96F6-43A7-A747-C6AEEDE961E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*", "matchCriteriaId": "DC35882B-E709-42D8-8800-F1B734CEAFC3", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*", "matchCriteriaId": "B7A47276-F241-4A68-9458-E1481EBDC5E6", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*", "matchCriteriaId": "12D0D469-6C9B-4B66-9581-DC319773238A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*", "matchCriteriaId": "40629BEB-DF4B-4FB8-8D3D-7BAC43C90766", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*", "matchCriteriaId": "9503131F-CC23-4545-AE9C-9714B287CC25", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*", "matchCriteriaId": "B4CE2D12-AD31-4FED-AD0F-ADF64E92E1B1", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*", "matchCriteriaId": "8113A4E3-AA96-4382-815D-6FD88BA42EC5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*", "matchCriteriaId": "DC8C28E0-6C51-41EE-A7B2-DB185D1D8FD0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*", "matchCriteriaId": "BC19F11D-23D9-429D-A957-D67F23A40A01", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*", "matchCriteriaId": "AAFA2EE7-C965-4F27-8CAE-E607A9F202AD", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*", "matchCriteriaId": "1D09DCF6-1C8F-4CA1-B7D4-AFDD4EB35771", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*", "matchCriteriaId": "C52705E6-2C6B-47BC-A0CD-F6AAE0BFC302", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*", "matchCriteriaId": "D659AE6A-591E-4D5B-9781-9648250F5576", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*", "matchCriteriaId": "E4054E3E-561C-4B1C-A615-3CCE5CB69D77", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*", "matchCriteriaId": "4FA0E9C4-25E4-4CD6-B88A-02B413385866", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*", "matchCriteriaId": "5D6F7CA3-C36A-466C-8FAD-D0B3CEF01F0E", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*", "matchCriteriaId": "9684AC81-B557-4292-8402-AE55CB2E613C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*", "matchCriteriaId": "32A352C4-0E9C-436F-ADA7-D93492A18037", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p39:*:*:*:*:*:*", "matchCriteriaId": "ABCA8698-AB88-4A6D-BD2B-DB22AEED6536", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*", "matchCriteriaId": "33F50D8C-7027-4A8D-8E95-98C224283772", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p40:*:*:*:*:*:*", "matchCriteriaId": "CEE1CBDD-F205-4EA7-9E8B-5527BC134C74", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*", "matchCriteriaId": "82000BA4-1781-4312-A7BD-92EC94D137AE", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*", "matchCriteriaId": "4B52D301-2559-457A-8FFB-F0915299355A", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*", "matchCriteriaId": "7215AE2C-8A33-4AB9-88D5-7C8CD11E806C", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*", "matchCriteriaId": "8D859F77-8E39-4D46-BC90-C5C1D805A666", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*", "matchCriteriaId": "CDC810C7-45DA-4BDF-9138-2D3B2750243E", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*", "matchCriteriaId": "E09D95A4-764D-4E0B-8605-1D94FD548AB2", "vulnerable": true}, {"criteria": "cpe:2.3:a:zimbra:collaboration:10.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "6198F75A-353D-4079-91DE-A7CC22DFE8B0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE)."}, {"lang": "es", "value": " Se descubri\u00f3 un problema en Zimbra Collaboration (ZCS) 10.1.x anterior a 10.1.1, 10.0.x anterior a 10.0.9, 9.0.0 anterior al parche 41 y 8.8.15 anterior al parche 46. Permite a los usuarios autenticados explotar Server-Side Request Forgery (SSRF) debido a una desinfecci\u00f3n de entrada incorrecta y una lista blanca de dominios mal configurada. Este problema permite que se env\u00eden solicitudes HTTP no autorizadas a servicios internos, lo que puede provocar una ejecuci\u00f3n de c\u00f3digo remoto (RCE) al encadenar la inyecci\u00f3n de comandos dentro del servicio interno. Cuando se combina con las vulnerabilidades XSS existentes, este problema de SSRF puede facilitar a\u00fan m\u00e1s la ejecuci\u00f3n de c\u00f3digo remoto (RCE)."}], "id": "CVE-2024-45518", "lastModified": "2024-10-30T21:23:59.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2024-10-22T17:15:03.837", "references": [{"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://wiki.zimbra.com/wiki/Security_Center"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes"}, {"source": "cve@mitre.org", "tags": ["Release Notes"], "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes"}, {"source": "cve@mitre.org", "tags": ["Product"], "url": "https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-918"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}