Published on May 30th, 2019 📆 | 2255 Views ⚑
0Synacor Zimbra Collaboration Suite up to 8.7.11p9 mailboxd XML External Entity
CVSS Meta Temp Score | Current Exploit Price (β) |
---|---|
5.1 | $0-$5k |
A vulnerability was found in Synacor Zimbra Collaboration Suite up to 8.7.11p9 (Groupware Software) and classified as critical. Affected by this issue is a part of the component mailboxd. The manipulation with an unknown input leads to a privilege escalation vulnerability (XXE). Using CWE to declare the problem leads to CWE-611. Impacted is confidentiality, integrity, and availability.
The bug was discovered 04/11/2019. The weakness was released 05/29/2019 as EDB-ID 46693 as uncorroborated exploit (Exploit-DB). The advisory is shared for download at exploit-db.com. This vulnerability is handled as CVE-2019-9670 since 03/11/2019. Technical details are unknown but a public exploit is available.
After immediately, there has been an exploit disclosed. It is declared as proof-of-concept. The exploit is available at exploit-db.com. The vulnerability was handled as a non-public zero-day exploit for at least 48 days. During that time the estimated underground price was around $0-$5k.
Applying the patch 8.7.11p9 is able to eliminate this problem.
Entry connected to this vulnerability is available at 134245.
Vendor
Name
VulDB Meta Base Score: 5.5
VulDB Meta Temp Score: 5.1
VulDB Base Score: β5.5
VulDB Temp Score: β5.1
VulDB Vector: π
VulDB Reliability: π
VulDB Base Score: π
VulDB Temp Score: π
VulDB Reliability: π
Class: Privilege escalation / XXE (CWE-611)
Local: Yes
Remote: No
Availability: π
Access: Public
Status: Proof-of-Concept
Download: π
Price Prediction: π
Current Price Estimation: π
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Exploit-DB: π
Threat Intelligence
Threat: π
Adversaries: π
Geopolitics: π
Economy: π
Predictions: π
Remediation: πRecommended: Patch
Status: π
0-Day Time: π
Exploit Delay Time: π
Patch: 8.7.11p9
03/11/2019 CVE assigned
04/11/2019 Vulnerability found
05/29/2019 Advisory disclosed
05/29/2019 Exploit disclosed
05/29/2019 EDB entry disclosed
05/30/2019 VulDB entry created
05/30/2019 VulDB last updateAdvisory: EDB-ID 46693
Status: Uncorroborated
CVE: CVE-2019-9670 (π)
OSVDB: - Zimbra Collaboration Suite Proxy Servlet server-side request forgery
See also: π
Created: 05/30/2019 09:49 AM
Complete: π
Download it now for free!
https://vuldb.com/?id.135716
Gloss