CVE-2022-37042

Estado: AnalizadaCrítica (9.8)⚠ Explotación activa💥 Exploit

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 92%
Percentil entre todas las CVEs puntuadas: 100
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 11/8/2022
Plazo de remediación: 1/9/2022
Uso conocido en ransomware: Known

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

Módulo de Metasploit (exploit fiable y al alcance de cualquiera) · Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925)
Plantilla de Nuclei (detección automática y masiva) · Zimbra Collaboration Suite 8.8.15/9.0 - Remote Code Execution
Prueba de concepto en GitHub (no verificada) · Lista de pruebas de concepto en GitHub

⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %

Vulnerabilidad crítica (CVSS 9.8) en endpoint web mboximport sin autenticación (AV:N/PR:N/UI:N) permitiendo ejecución remota de código mediante directory traversal tras upload de ZIP malicioso. Explotación remota directa sin privilegios.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Filter Network Traffic Application Isolation and Sandboxing

Tecnologías afectadas (1)

Synacor — Zimbra Collaboration Suite

CWE

CWE-22
CWE-22

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2022-37042",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-37042",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2022-08-10T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-08-12T15:15:16.053",
  "references": [
    {
      "url": "http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Security_Center",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Security_Center",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37042",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925."
    },
    {
      "lang": "es",
      "value": "Zimbra Collaboration Suite (ZCS) versiones 8.8.15 y 9.0, presenta una funcionalidad mboximport que recibe un archivo ZIP y extrae archivos de él. Al omitir la autenticación (es decir, al no tener un authtoken), un atacante puede cargar archivos arbitrarios en el sistema, conllevando a un salto de directorios y una ejecución de código remota. NOTA: este problema existe debido a una corrección incompleta de CVE-2022-27925."
    }
  ],
  "lastModified": "2026-08-04T05:16:29.020",
  "cisaActionDue": "2022-09-01",
  "cisaExploitAdd": "2022-08-11",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E39A855-C0EB-4448-AE96-177757C40C66"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FFE7BE6E-7A9A-40C7-B236-7A21103E9F41"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5924FFC-BA19-48B3-BF4D-0C2DB3FCD407"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7822D273-C2CB-4EFE-B929-3D34C65E005E"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F81528E8-FE3A-4C48-A747-34A3FF28BCAB"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D772D4BA-9ED6-492C-A0D3-0AF4F3D49037"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2A468FE-B59B-4CE9-B9B2-C836EEAFA3E8"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "04BECDE0-F082-49FB-ACA2-5C808902AA17"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p16:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56558FD4-4391-4199-BA6B-B53F5DC30144"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69A530D3-B84E-427B-BC92-64BBFEF331BE"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p18:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C0DCE7F-85A4-44C6-88C8-380B0BBBFA7E"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p19:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "180AF8B6-55AE-460C-B613-37FB697B5325"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6FCB5528-70FD-4525-A78B-D5537609331A"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p20:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "34B07279-A26A-4EB1-8B33-885AD854018B"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p21:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97402ADA-AB05-4A92-920D-EA5363424FDF"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p22:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "697A1D34-FF0C-4F9E-8E91-34404A366D70"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p23:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9030D096-87A1-4AFF-BB7C-CE71990005B3"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p24:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F211A8B1-E33E-49BE-9C18-31B1902EB4FE"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p25:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4152CEA2-9DC1-4567-BAB3-9C36F74F77EA"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p26:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9BC02B35-7FC4-41AB-8D2E-2CD1896D84C6"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p27:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0294CB8B-B0AF-4A5C-B6B2-33F5BFFFBD4C"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p28:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "968A75B4-6D23-4B83-A8B5-777D8F151E04"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p29:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E11BC24-56A3-4CAB-B0B2-D2430CD80767"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EF2EE32D-04A5-46EA-92F0-3C8D74A4B82A"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p30:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50FB0099-0495-4735-9398-7F7E657F459B"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FAE2858A-6D9E-4D79-AFA6-69C44D6D8C75"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p31.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C1D9EB8-E3FE-4BF3-8517-603BA4B126C2"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p32:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50A296BC-6DA4-41B2-923A-0633566AD6C1"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BB3C28CA-4C22-423E-B1C7-CBAFBB91F4DB"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A9A1314A-20C8-42D7-9387-D914999EEAF6"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEF091C5-8DC6-4A41-9E84-F53BE703F71B"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACD65C28-9716-4073-8613-C4AF12684760"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C58AFFF-848F-490D-A95C-03A267C2DC98"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B62DC188-89A8-4AEA-90AE-563F0BBEFC54"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32AFCE22-5ADA-4FF7-A165-5EC12B325DEF"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D3577FE6-F1F4-4555-8D27-84D6DE731EA3"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "931BD98E-1A5F-4634-945B-BDD7D2FAA8B0"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2E7C0A57-A887-4D29-B601-4275313F46B3"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7248B91-D136-4DD5-A631-737E4C220A02"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "494F6FD4-36ED-4E40-8336-7F077FA80FA8"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DF8C0CE-A71D-4BB1-83FB-1EA5ED77E0C9"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E0648498-2EE5-4B68-8360-ED5914285356"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p16:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24282FF8-548B-415B-95CA-1EFD404D21D3"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACFDF2D9-ED72-4969-AA3B-E8D48CB1922D"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p18:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B7D0A8B-7A72-4C1A-85F2-BE336CA47E0B"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p19:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "019AFC34-289E-4A01-B08B-A5807F7F909A"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7E7B3976-DA6F-4285-93E6-2328006F7F4D"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p20:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "062E586F-0E02-45A6-93AD-895048FC2D4C"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p21:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3EE37BEE-4BDB-4E62-8DE3-98CF74DFBE01"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p22:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADF51BCA-37DD-4642-B201-74A6D1A545FF"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p23:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "39611F3D-A898-4C35-8915-3334CDFB78E5"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40AB56B7-7222-4C44-A271-45DFE3673F72"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p24.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AE8F501-4528-4F15-AE50-D4F11FB462DE"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p25:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB9E054B-7790-4E74-A771-40BF6EC71610"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FA310AFA-492D-4A6C-A7F6-740E82CB6E57"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2AF337B5-B296-449B-8848-7636EC7C46C5"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52232ACA-C158-48C8-A0DB-7689040CB8FB"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3B4D0040-86D0-46C3-8A9A-3DD12138B9ED"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D2BB9BC7-078D-4E08-88E4-9432D74CA9BA"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F04D4B77-D386-4BC8-8169-9846693F6F11"
            },
            {
              "criteria": "cpe:2.3:a:synacor:zimbra_collaboration_suite:9.0.0:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "992370FA-F171-4FB3-9C1C-58AC37038CE4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability"
}