CVE-2019-9670
Published 2019-05-29 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2019-9670 is a critical-severity (CVSS 9.8) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). CISA added it to the Known Exploited Vulnerabilities catalog on January 10, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by July 10, 2022. CISA does not currently list it as used in ransomware campaigns. Synacor has 19 vulnerabilities in the KEV catalog, 6 of them linked to ransomware.
All 19 known-exploited Synacor vulnerabilities →Description
mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Synacor — Zimbra Collaboration Suite (ZCS)
Name: Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference
Date added: 2022-01-10 · Due: 2022-07-10
Required action: Apply updates per vendor instructions.
References
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
- https://bugzilla.zimbra.com/show_bug.cgi?id=109129
- https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://www.exploit-db.com/exploits/46693/
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce