CVE-2019-9670

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2019-9670

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9670.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2019-9670

Published

2019-05-29T22:29:01.507Z

Modified

2026-07-08T19:51:54.173740Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

References

Affected packages

Git

github.com/zimbra/zm-build

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-build

Events

Introduced

Fixed

6c3c77b328a0d7d3bafecb79d202960217922ef0

Introduced

6c3c77b328a0d7d3bafecb79d202960217922ef0

Last affected

e4d1e657f1d2a5a5e8c56c11d7da34ef61574591

Database specific

{
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p6:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p7:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p8:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p9:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "8.7.0"
        },
        {
            "fixed": "8.7.11"
        },
        {
            "introduced": "8.7.11-NA"
        },
        {
            "last_affected": "8.7.11-NA"
        },
        {
            "introduced": "8.7.11-p1"
        },
        {
            "last_affected": "8.7.11-p1"
        },
        {
            "introduced": "8.7.11-p2"
        },
        {
            "last_affected": "8.7.11-p2"
        },
        {
            "introduced": "8.7.11-p3"
        },
        {
            "last_affected": "8.7.11-p3"
        },
        {
            "introduced": "8.7.11-p4"
        },
        {
            "last_affected": "8.7.11-p4"
        },
        {
            "introduced": "8.7.11-p5"
        },
        {
            "last_affected": "8.7.11-p5"
        },
        {
            "introduced": "8.7.11-p6"
        },
        {
            "last_affected": "8.7.11-p6"
        },
        {
            "introduced": "8.7.11-p7"
        },
        {
            "last_affected": "8.7.11-p7"
        },
        {
            "introduced": "8.7.11-p8"
        },
        {
            "last_affected": "8.7.11-p8"
        },
        {
            "introduced": "8.7.11-p9"
        },
        {
            "last_affected": "8.7.11-p9"
        }
    ]
}

Affected versions

8.*

8.7.10

8.7.11

8.7.11-NA

8.7.11-p1

8.7.11-p2

8.7.11-p3

8.7.11-p4

8.7.11-p5

8.7.11-p6

8.7.11-p7

8.7.11-p8

8.7.11-p9

8.7.11.p1

8.7.11.p2

8.7.11.p3

8.7.11.p4

8.7.11.p5

8.7.11.p6

8.7.11.p7

8.7.11.p8

8.7.11.p9

8.7.6

8.7.7

8.7.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9670.json"

github.com/zimbra/zm-mailbox

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-mailbox

Events

Introduced

Fixed

65929222951131db2cbb2378accbdd5f2fac0980

Introduced

65929222951131db2cbb2378accbdd5f2fac0980

Last affected

7bcb07bd565ac40849e0dcabb70c6087396fac56

Database specific

{
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p2:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p5:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p6:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p7:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p8:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p9:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "8.7.0"
        },
        {
            "fixed": "8.7.11"
        },
        {
            "introduced": "8.7.11-NA"
        },
        {
            "last_affected": "8.7.11-NA"
        },
        {
            "introduced": "8.7.11-p1"
        },
        {
            "last_affected": "8.7.11-p1"
        },
        {
            "introduced": "8.7.11-p2"
        },
        {
            "last_affected": "8.7.11-p2"
        },
        {
            "introduced": "8.7.11-p3"
        },
        {
            "last_affected": "8.7.11-p3"
        },
        {
            "introduced": "8.7.11-p4"
        },
        {
            "last_affected": "8.7.11-p4"
        },
        {
            "introduced": "8.7.11-p5"
        },
        {
            "last_affected": "8.7.11-p5"
        },
        {
            "introduced": "8.7.11-p6"
        },
        {
            "last_affected": "8.7.11-p6"
        },
        {
            "introduced": "8.7.11-p7"
        },
        {
            "last_affected": "8.7.11-p7"
        },
        {
            "introduced": "8.7.11-p8"
        },
        {
            "last_affected": "8.7.11-p8"
        },
        {
            "introduced": "8.7.11-p9"
        },
        {
            "last_affected": "8.7.11-p9"
        }
    ]
}

Affected versions

8.*

8.7.10

8.7.11

8.7.11-NA

8.7.11-p1

8.7.11-p2

8.7.11-p3

8.7.11-p4

8.7.11-p5

8.7.11-p6

8.7.11-p7

8.7.11-p8

8.7.11-p9

8.7.11.p1

8.7.11.p2

8.7.11.p3

8.7.11.p4

8.7.11.p5

8.7.11.p6

8.7.11.p7

8.7.11.p8

8.7.11.p9

8.7.6

8.7.7

8.7.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9670.json"

github.com/zimbra/zm-zcs

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-zcs

Events

Introduced

Fixed

e177bad87d5312e7b2cd1915ae8c0cd2528cacdb

Introduced

e177bad87d5312e7b2cd1915ae8c0cd2528cacdb

Last affected

665cf237e9af42122681f08b9fa7a10d1a35aac3

Database specific

{
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p1:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "8.7.0"
        },
        {
            "fixed": "8.7.11"
        },
        {
            "introduced": "8.7.11-NA"
        },
        {
            "last_affected": "8.7.11-NA"
        },
        {
            "introduced": "8.7.11-p1"
        },
        {
            "last_affected": "8.7.11-p1"
        }
    ]
}

Affected versions

8.*

8.7.10

8.7.11

8.7.11-NA

8.7.11-p1

8.7.11.p1

8.7.6

8.7.7

8.7.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9670.json"

github.com/zimbra/zm-zcs-lib

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-zcs-lib

Events

Introduced

Fixed

a1cbf80618e47b3cf0894cbbcaec1da9bece583c

Introduced

a1cbf80618e47b3cf0894cbbcaec1da9bece583c

Last affected

89d7224f1513c35311733d27e602b6c912d01ed2

Database specific

{
    "cpe": [
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:-:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p3:*:*:*:*:*:*",
        "cpe:2.3:a:synacor:zimbra_collaboration_suite:8.7.11:p4:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "8.7.0"
        },
        {
            "fixed": "8.7.11"
        },
        {
            "introduced": "8.7.11-NA"
        },
        {
            "last_affected": "8.7.11-NA"
        },
        {
            "introduced": "8.7.11-p3"
        },
        {
            "last_affected": "8.7.11-p3"
        },
        {
            "introduced": "8.7.11-p4"
        },
        {
            "last_affected": "8.7.11-p4"
        }
    ]
}

Affected versions

8.*

8.7.10

8.7.11

8.7.11-NA

8.7.11-p3

8.7.11.p3

8.7.11.p4

8.7.6

8.7.7

8.7.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-9670.json"