CVE-2024-45518 | Vulnetix

CVE-2024-45518 PUBLISHED CVSS 8.600000381469727 HIGH

An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE).

EPSS 20.18% · 97.2th percentile

Risk Scores

CVSS 4.0

8.600000381469727

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:N

EPSS Score

20.18%

97.2th percentile

Affected Products

Vendor	Product	Versions
zimbra	collaboration	10.1.0, 10.0.0, 9.0.0
n/a	n/a	n/a
zimbra	collaboration	10.0.0, 8.8.15, 8.8.15

Timeline

Sep 5, 2024 CVE Published
Oct 22, 2024 Coalition ESS Score
Oct 22, 2024 Coalition ESS Score
Oct 22, 2024 PoC Published
Oct 23, 2024 EPSS Score
Oct 23, 2024 Coalition ESS Score
Oct 30, 2024 Coalition ESS Score
Nov 29, 2024 EPSS Score
Dec 18, 2024 EPSS Score
Jan 24, 2025 EPSS Score
Feb 11, 2025 EPSS Score
Mar 11, 2025 Coalition ESS Score

References

Open in Interactive Console →