CVE-2022-37042
Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability
Published Aug 11, 2022 · updated Aug 3, 2026 · synacor zimbra collaboration suite
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Timeline
Detection, updates, and resolution for this record.
Aug 11, 2022 · Catalog
Detected
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Aug 11, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Sep 1, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Aug 3, 2026 · Catalog
Updated
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Required action
Apply updates per vendor instructions.
CISA due date Sep 1, 2022
Affected
- cpe synacor/zimbra collaboration suite8.8.15
- vendor Synacor Zimbra Collaboration Suite (ZCS)version unspecified
Sources
- CISA KEVCVE-2022-37042
Synacor Zimbra Collaboration Suite (ZCS) contains an authentication bypass vulnerability in MailboxImportServlet. This vulnerability was chained with CVE-2022-27925 which allows for unauthenticated remote code execution.
cisa.gov - CVE.orgCVE-2022-37042
Official CVE identifier
cve.org - FIRST EPSSCVE-2022-37042
30-day exploitation probability 91.9%
first.org - Metasploit Modulesexploit_linux/http/zimbra_mboximport_cve_2022_27925
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2022-37042
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal a
nvd.nist.gov