CVE-2022-27925

HIGHCVSS 7.2Known Exploited

CISA Known Exploited Vulnerability

https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/; https://nvd.nist.gov/vuln/detail/CVE-2022-27925

Remediation deadline: September 1, 2022

Ransomware use: Known

Description

Synacor Zimbra Collaboration Suite (ZCS) contains flaw in the mboximport functionality, allowing an authenticated attacker to upload arbitrary files to perform remote code execution. This vulnerability was chained with CVE-2022-37042 which allows for unauthenticated remote code execution.

Timeline

Published:April 21st, 2022 12:15 AM

Last modified:August 4th, 2026 5:16 AM

Added to KEV:August 11th, 2022

CVSS Scoring

CVSS v3: 7.2 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2: 6.5

Affected Software

From NVD CPE configuration data

Vendors

synacor

Products

zimbra_collaboration_suite

Weaknesses (CWE)

CWE-22

References & Reports

Advisories, patches, and third-party reports

Source: NIST NVD · Data may lag official sources by up to one minute