CVE-2024-33535

Estado: ModificadaAlta (7.5)—
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without authentication, potentially leading to unauthorized access to sensitive information. The vulnerability is limited to files within a specific directory.
CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Puntuación base: 7.5
Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.55%
Percentil entre todas las CVEs puntuadas: 44
Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)

Zimbra — Collaboration
CWE

CWE-22
CWE-22
Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-33535",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-33535",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-12T18:13:11.747339Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-08-12T15:15:20.570",
  "references": [
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.8#Security_Fixes",
      "tags": [
        "Release Notes"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P40#Security_Fixes",
      "tags": [
        "Release Notes"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The vulnerability involves unauthenticated local file inclusion (LFI) in a web application, specifically impacting the handling of the packages parameter. Attackers can exploit this flaw to include arbitrary local files without authentication, potentially leading to unauthorized access to sensitive information. The vulnerability is limited to files within a specific directory."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en Zimbra Collaboration (ZCS) 9.0 y 10.0. La vulnerabilidad implica la inclusión de archivos locales (LFI) no autenticados en una aplicación web, lo que afecta específicamente el manejo del parámetro de paquetes. Los atacantes pueden aprovechar esta falla para incluir archivos locales arbitrarios sin autenticación, lo que podría conducir a un acceso no autorizado a información confidencial. La vulnerabilidad se limita a archivos dentro de un directorio específico."
    }
  ],
  "lastModified": "2026-06-17T07:31:56.447",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A5BC091A-EE5A-4D34-9D2E-754D3C2FCA3F",
              "versionEndExcluding": "10.0.8",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "685D9652-2934-4C13-8B36-40582C79BFC1"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E4DF01A-1AA9-47E8-82FD-65A02ECA1376"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDE59185-B917-4A81-8DE4-C65A079F52FE"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BA3ED95F-95F2-4676-8EAF-B4B9EB64B260"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BB93336-CC3C-4B7F-B194-7DED036ABBAF"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "876F1675-F65C-4E86-ADBD-36EB8D8A997D"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2306F526-9C56-4A57-AA9B-02F2D6058C97"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9EA2A61-67AA-4B7E-BC6E-80EB1363EF85"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C77A35B7-96F6-43A7-A747-C6AEEDE961E1"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC35882B-E709-42D8-8800-F1B734CEAFC3"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B7A47276-F241-4A68-9458-E1481EBDC5E6"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "12D0D469-6C9B-4B66-9581-DC319773238A"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40629BEB-DF4B-4FB8-8D3D-7BAC43C90766"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9503131F-CC23-4545-AE9C-9714B287CC25"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B4CE2D12-AD31-4FED-AD0F-ADF64E92E1B1"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8113A4E3-AA96-4382-815D-6FD88BA42EC5"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DC8C28E0-6C51-41EE-A7B2-DB185D1D8FD0"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC19F11D-23D9-429D-A957-D67F23A40A01"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AAFA2EE7-C965-4F27-8CAE-E607A9F202AD"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1D09DCF6-1C8F-4CA1-B7D4-AFDD4EB35771"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C52705E6-2C6B-47BC-A0CD-F6AAE0BFC302"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FD1DCE2B-D944-43AE-AD0E-9282DE6D618F"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2079B9F8-128B-487D-A965-E8B37FDF6304"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9679FD62-815E-47A8-8552-D28CE48B82B2"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D659AE6A-591E-4D5B-9781-9648250F5576"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E4054E3E-561C-4B1C-A615-3CCE5CB69D77"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4FA0E9C4-25E4-4CD6-B88A-02B413385866"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D6F7CA3-C36A-466C-8FAD-D0B3CEF01F0E"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9684AC81-B557-4292-8402-AE55CB2E613C"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32A352C4-0E9C-436F-ADA7-D93492A18037"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p39:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABCA8698-AB88-4A6D-BD2B-DB22AEED6536"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33F50D8C-7027-4A8D-8E95-98C224283772"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82000BA4-1781-4312-A7BD-92EC94D137AE"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B52D301-2559-457A-8FFB-F0915299355A"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7215AE2C-8A33-4AB9-88D5-7C8CD11E806C"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8D859F77-8E39-4D46-BC90-C5C1D805A666"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDC810C7-45DA-4BDF-9138-2D3B2750243E"
            },
            {
              "criteria": "cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E09D95A4-764D-4E0B-8605-1D94FD548AB2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}