VDB
CVE-2025-25064
CVE-2025-25064
PUBLISHED
CVSS 9.800000190734863 CRITICAL
SQL injection vulnerability in the ZimbraSyncService SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4.
EPSS 36.73% · 98.4th percentile
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
36.73%
98.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| synacor | zimbra_collaboration_suite | 10.0.0, 10.1.0 |
Timeline
- Dec 18, 2024 CVE Published
- Feb 3, 2025 PoC Published
- Feb 3, 2025 PoC Published
- Feb 3, 2025 PoC Published
- Feb 4, 2025 EPSS Score
- Feb 4, 2025 PoC Published
- Feb 4, 2025 PoC Published
- Feb 10, 2025 PoC Published
- Feb 10, 2025 PoC Published
- Feb 10, 2025 PoC Published
- Feb 10, 2025 PoC Published
- Feb 10, 2025 PoC Published
References
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories url
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes url
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12#Security_Fixes url
- https://nvd.nist.gov/vuln/detail/CVE-2025-25064 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P47 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P43 advisory
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4 advisory