VDB
CVE-2024-27442
CVE-2024-27442
PUBLISHED
CVSS 8.600000381469727 HIGH
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation.
EPSS 0.04% · 11.6th percentile
Risk Scores
CVSS 4.0
8.600000381469727
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.04%
11.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| zimbra | collaboration | 9.0, 10.0, 9.0 |
| n/a | n/a | *, n/a |
| zimbra | collaboration | 10.0.0, 9.0.0, 9.0.0 |
Exploit Intelligence
Timeline
- Feb 28, 2024 CVE Published
- Aug 12, 2024 PoC Published
- Aug 13, 2024 EPSS Score
- Aug 13, 2024 CVE Updated
- Sep 3, 2024 EPSS Score
- Sep 24, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 14, 2024 EPSS Score
- Nov 4, 2024 EPSS Score
- Nov 25, 2024 EPSS Score
- Dec 17, 2024 EPSS Score
- Jan 7, 2025 EPSS Score
References
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes url
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes url
- https://nvd.nist.gov/vuln/detail/CVE-2024-27442 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7 advisory