{"id":"CVE-2022-37042","published":"2022-08-12T15:15:16Z","modified":"2026-08-04T05:16:29Z","title":"Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability","vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","tier":"core","eol":null,"description":{"text":"Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an authentication bypass in the mboximport functionality of Synacor's Zimbra Collaboration Suite (ZCS), which receives and extracts files from ZIP archives. An unauthenticated remote attacker with network access can upload arbitrary files through this path, using directory traversal to write them anywhere on the system and achieve remote code execution, with no user interaction or valid authentication token required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:42Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.92072,"percentile":0.9982,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-08-11","dueDate":"2022-09-01","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://blog.zimbra.com/2022/08/authentication-bypass-in-mailboximportservlet-vulnerability/;  https://nvd.nist.gov/vuln/detail/CVE-2022-37042","provenance":"source"},"vulncheckKev":{"dateAdded":"2022-08-10","exploitedFirstSeen":"2022-08-10","ransomware":true,"evidence":[{"url":"https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/","date":"2022-08-10"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-08-11"},{"url":"https://assets.sentinelone.com/wt-reports/watchtower_2022_eoy","date":"2023-01-18"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-228a","date":"2023-01-27"},{"url":"https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf","date":"2023-02-02"},{"url":"https://socradar.io/threat-actor-profile-bianlian-the-shape-shifting-ransomware-group/","date":"2023-07-13"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa23-278a","date":"2023-10-05"},{"url":"https://cyberint.com/blog/research/ransomware-trends-q3-2023-report/","date":"2023-10-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-13&host_type=src&vulnerability=cve-2022-37042","date":"2023-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2023-11-15&host_type=src&vulnerability=cve-2022-37042","date":"2023-11-15"}],"evidenceTotal":975,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"},{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Patch","Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Patch","Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37042","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated upload to public-facing mail server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files","start":133,"end":232}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Uploaded files yield remote code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"leading to directory traversal and remote code execution","start":248,"end":304}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2022-39696","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39696","exploited":true,"exploitedSince":"2022-08-11","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2022-08-18","earliestUrl":"https://github.com/GreyNoise-Intelligence/Zimbra_CVE-2022-37042-_CVE-2022-27925","repos":[{"name":"0xf4n9x/CVE-2022-37042","url":"https://github.com/0xf4n9x/CVE-2022-37042","stars":28,"created":"2022-10-24"},{"name":"aels/CVE-2022-37042","url":"https://github.com/aels/CVE-2022-37042","stars":19,"created":"2022-08-25"},{"name":"GreyNoise-Intelligence/Zimbra_CVE-2022-37042-_CVE-2022-27925","url":"https://github.com/GreyNoise-Intelligence/Zimbra_CVE-2022-37042-_CVE-2022-27925","stars":7,"created":"2022-08-18"}]},"metasploit":[{"name":"Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925)","module":"exploit/linux/http/zimbra_mboximport_cve_2022_27925","type":"exploit","disclosureDate":"2022-05-10","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_mboximport_cve_2022_27925.rb"}],"nuclei":[{"id":"CVE-2022-37042","name":"Zimbra Collaboration Suite 8.8.15/9.0 - Remote Code Execution","severity":"critical","path":"http/cves/2022/CVE-2022-37042.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-37042.yaml"}],"first":{"date":"2022-05-10","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_mboximport_cve_2022_27925.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2022-05-10","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2022-08-18","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_mboximport_cve_2022_27925.rb","provenance":"source"},{"date":"2022-08-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/","provenance":"source"},{"date":"2022-08-11","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-08-11","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-39696","provenance":"source"},{"date":"2022-08-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37042","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1543 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.96,"detail":"percentile 0.9982"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 3 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-synacor-zimbra-collaboration-suite-zcs-cve-2022-27925","parents":[{"from":"CVE-2022-27925","to":"CVE-2022-37042","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.","from":"NVD","in":"CVE-2022-37042"},{"kind":"similar","provenance":"machine","score":0.72,"basis":"same product + CWE + description similarity"}]}]}}