Zimbra Releases Patch for Actively Exploited Vulnerability in its Collaboration Suite
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-1197 | cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive | 1.9 | 3% | PoC ×3 | |
| CVE-2022-41352 | Path Traversal Arbitrary File Upload in Synacor Zimbra Collaboration Suite | 9.8 | 95% | KEVRansomwarePoC | KEV |
From the original article
2 min read at thehackernews.com
Zimbra has released patches to contain an actively exploited security flaw in its enterprise collaboration suite that could be leveraged to upload arbitrary files to vulnerable instances. Tracked as CVE-2022-41352 (CVSS score: 9. 8), the issue affects a component of the Zimbra suite called Amavis , an open source content filter, and more specifically, the cpio utility it uses to scan and extract archives.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.