CVE-2025-25065 — Vulnetix

CVE-2025-25065 PUBLISHED CVSS 5.300000190734863 MEDIUM

SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to internal network endpoints.

EPSS 0.41% · 61.6th percentile

Risk Scores

CVSS 3.1

5.300000190734863

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score

0.41%

61.6th percentile

Affected Products

Vendor	Product	Versions
synacor	zimbra_collaboration_suite	9.0.0, 0, 10.0.0
n/a	n/a	n/a

Exploit Intelligence

CIRCL seen: CVE-2025-25065 (circl-sighting)
CIRCL seen: CVE-2025-25065 (circl-sighting)
CIRCL seen: CVE-2025-25065 (circl-sighting)
CIRCL seen: CVE-2025-25065 (circl-sighting)
CIRCL seen: CVE-2025-25065 (circl-sighting)
CIRCL seen: CVE-2025-25065 (circl-sighting)
CIRCL seen: CVE-2025-25065 (circl-sighting)
CIRCL seen: CVE-2025-25065 (circl-sighting)
https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes (circl)
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories (circl)

…and 8 more exploits

Timeline

Feb 3, 2025 CVE ID Reserved
Feb 3, 2025 CVE Published
Feb 3, 2025 PoC Published
Feb 3, 2025 PoC Published
Feb 3, 2025 PoC Published
Feb 4, 2025 EPSS Score
Feb 10, 2025 PoC Published
Feb 11, 2025 PoC Published
Feb 11, 2025 PoC Published
Feb 11, 2025 PoC Published
Feb 19, 2025 EPSS Score
Mar 6, 2025 EPSS Score

References

Open in Interactive Console →