CVE-2024-45519
Published 2024-10-02 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2024-45519 is a critical-severity (CVSS 10.0) vulnerability in Synacor Zimbra Collaboration Suite (ZCS). CISA added it to the Known Exploited Vulnerabilities catalog on October 3, 2024, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by October 24, 2024. CISA does not currently list it as used in ransomware campaigns. Synacor has 19 vulnerabilities in the KEV catalog, 6 of them linked to ransomware.
All 19 known-exploited Synacor vulnerabilities →Description
The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Synacor — Zimbra Collaboration Suite (ZCS)
Name: Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
Date added: 2024-10-03 · Due: 2024-10-24
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
References
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.9#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.1#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P46#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P41#Security_Fixes
- https://wiki.zimbra.com/wiki/Zimbra_Responsible_Disclosure_Policy
- https://blog.projectdiscovery.io/zimbra-remote-code-execution/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-45519