high7.5Known exploitedPublic exploit code
CVE-2019-9621
Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-07-07. Federal due date: 2025-07-28.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)2019-04-12 · remote · linux · Verified
- Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery2019-06-05 · webapps · jsp
Impact
Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Synacor | Zimbra Collaboration Suite | before 8.6.0 from 8.7.0 before 8.7.11 from 8.8.0 before 8.8.9 Versions 8.6.0, 8.7.11, 8.8.9 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
- http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
- https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html
- https://blog.zimbra.com/2019/03/9826/
- https://bugzilla.zimbra.com/show_bug.cgi?id=109127
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://www.exploit-db.com/exploits/46693/
- http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html
- http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html
- http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce
- https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html
- https://blog.zimbra.com/2019/03/9826/
- https://bugzilla.zimbra.com/show_bug.cgi?id=109127
- https://wiki.zimbra.com/wiki/Security_Center
- https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
- https://www.exploit-db.com/exploits/46693/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9621