HackerFeeds
All CVEs

CVE-2022-37042

CRITICAL9.8
CISA KEV

Published 2022-08-12 · Updated 2026-08-04 · Source cve@mitre.org

Summary

CVE-2022-37042 is a critical-severity (CVSS 9.8) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). CISA added it to the Known Exploited Vulnerabilities catalog on August 11, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 1, 2022. CISA also lists it as known to be used in ransomware campaigns, so it should be prioritised accordingly. Synacor has 19 vulnerabilities in the KEV catalog, 6 of them linked to ransomware.

All 19 known-exploited Synacor vulnerabilities →

Description

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-22CWE-22

CISA Known-Exploited Vulnerability

Product: Synacor — Zimbra Collaboration Suite (ZCS)

Name: Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability

Date added: 2022-08-11 · Due: 2022-09-01

USED IN RANSOMWARE

Required action: Apply updates per vendor instructions.

References

View on NVD