VulnerabilitycriticalExploited in the wild

CISA orders civilian agencies to patch Zimbra bug after mass exploitation

The RecordJan 11, 2023 · 00:00 UTC (Jan 11, 2023)3 min read1 · 1 read

Read at therecord.media

Analyze CVE-2022-37042 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2022-37042 CVE-2022-27925 CVE-2022-27924

Tags: cve-2022-37042 cve-2022-27925 cve-2022-27924 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2022-27924 +1 related CVE CVE-2022-27925	Unauthenticated Memcache Command Injection in Synacor Zimbra Collaboration Suite	7.5 group max	94%	KEVRansomware	Apr 21, 2022 KEV Aug 4, 2022
CVE-2022-37042	Unauthenticated ZIP Path Traversal RCE in Synacor Zimbra Collaboration Suite	9.8	92%	KEVRansomwarePoC	Aug 12, 2022 KEV Aug 11, 2022

From the original article

3 min read at therecord.media

The Cybersecurity and Infrastructure Security Agency added two vulnerabilities found in products from digital collaboration platform Zimbra after a cybersecurity company reported mass exploitation of the bugs throughout July and in early August. On Wednesday, Zimbra released an advisory urging its customers running older versions of the software to immediately install updates.

The Record

therecord.media

Read the full article at The Record

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.