CRITICALCVSS 9.8KNOWN EXPLOITEDRANSOMWARE: KNOWN

CVE-2022-37042

CVE-2022-37042 updated by NVD

Published: 2022-08-11
Modified: 2026-09-21
Sources: cisa-kev, nvd

Summary

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-37042

Includes data from the CISA Known Exploited Vulnerabilities catalog.

Includes data from the National Vulnerability Database (NIST). NVD data is in the public domain; this page is not endorsed by NIST.

CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.