VDB
CVE-2024-27442
CVE-2024-27442
PUBLISHED
CVSS 8.600000381469727 HIGH
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation.
EPSS 0.35% · 27.1th percentile
Risk Scores
CVSS 4.0
8.600000381469727
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.35%
27.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| zimbra | collaboration | 9.0, 10.0, 9.0 |
| n/a | n/a | *, n/a |
| zimbra | collaboration | 10.0.0, 9.0.0, 9.0.0 |
Timeline
- Feb 28, 2024 CVE Published
- Aug 12, 2024 PoC Published
- Aug 13, 2024 EPSS Score
- Sep 3, 2024 EPSS Score
- Sep 25, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 16, 2024 EPSS Score
- Nov 7, 2024 EPSS Score
- Nov 28, 2024 EPSS Score
- Dec 21, 2024 EPSS Score
- Jan 11, 2025 EPSS Score
- Feb 2, 2025 EPSS Score
References
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes url
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes url
- https://nvd.nist.gov/vuln/detail/CVE-2024-27442 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7 advisory