CVE-2022-37042

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-37042
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37042.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-37042
Published
2022-08-12T15:15:16.053Z
Modified
2025-12-11T02:04:23.842902Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

References

Affected packages

Git

github.com/zimbra/zm-build

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-build
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
03d99a16095b73a73770fbb6131d10234cfc13fd
Last affected
0e40da921adb967639011de45841cef4c4601413
Last affected
202d83762fca70b7403c144e1fedddc6cd4930a6
Last affected
29eea219faf34718f0ef1cda7c3f02c89910c96c
Last affected
5561a39cba0898c3bb5e188284d98f498d7a3c9a
Last affected
5ae8f73501330bc788daed9c82c1222857d85b8b
Last affected
62480d2f6aace77ee01bb4b8f46a3eff49cbdfd3
Last affected
71b1626efff0a90ba64ff3e5ab192683e6dccc9a
Last affected
905970576d6fe337150f09c0ad7a0f53aa1a8f42
Last affected
ac6081fa002b1511e926aba37740d2b6c20f3f43
Last affected
b6cd8f69d2761c014d4a3807f0bdee0011386444
Last affected
b7209ef3fd859fda5537cc7fbfdeb97cbd1ab931
Last affected
bcb978ccc354d99d843725886083e321759b6765
Last affected
c8a93da38fd1572d864c1becbcc772ba91ee4403
Last affected
d3209df466110d214b2ab6593f931a59c2127db8
Last affected
fe985a33cb83f82816a1e8f93d8d864112a6504e

Affected versions

8.*

8.7.10
8.7.11
8.7.6
8.7.7
8.7.9
8.8.0.beta1
8.8.10
8.8.11
8.8.11.p3
8.8.12
8.8.15
8.8.15.p3
8.8.15.p5
8.8.2
8.8.3
8.8.4
8.8.6
8.8.7
8.8.8
8.8.9
8.8.9.p1
8.8.9.p3

9.*

9.0.0
9.0.0.p4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37042.json"

github.com/zimbra/zm-mailbox

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-mailbox
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
02d6faf608d00dcae1954a85e8b76fbb9f220c3f
Last affected
042b0963ea86e965d9fcd036816ac87d6fe88b9b
Last affected
0cec5b69accc49c162439cd29dd181bba36be235
Last affected
10b7ff251aee6f4770ad75377a1f81491ad5bdb9
Last affected
1158e225529d2535fd5c9a4a04dd390a6767490e
Last affected
19ec057977b93892ef40c4d4d68b578bb8e4dea0
Last affected
2461b44fc509a2eac508891d17716afbf972d164
Last affected
24f005971a699a1b50f2aaddf401cf4b290c7299
Last affected
28f0aba4eab84a5aa28592a347459d79f1fac853
Last affected
2ec276e0cd140c34d2e8aa6e2260a10901e43a9d
Last affected
4576339cd43ab64c19dc87591825ab51cb79f07a
Last affected
459d2044a9a205efee2b8998be41762876174dde
Last affected
497eef64675f6ae63972c50c24e26048640748f6
Last affected
52c811a0259419b4e3d177f80c0ba7562d375cfa
Last affected
52e91d97aa3935023968de4dba9dc3c4d30fe55d
Last affected
58996926d8f031827e03ec788d69fd2d16739b1a
Last affected
5b8551b2bfdfc49af4ef5c7ca75f9c5061635031
Last affected
60555cd490710748f161320029fcbdfc3379adfd
Last affected
63c14463c4393c0fcdec4a470e448d1d7dab76d1
Last affected
751eb18e4c5495c9682d1d03074a53368c004f9d
Last affected
7a1bb7c8d0dafd59a551674e52c0b472d4cf275b
Last affected
7a895cdd697874d0b3e8b8caf58aca8587370df3
Last affected
7d74bc7bfd7f78c7261d0e52baf42716630fc3f0
Last affected
82e2bdc9c525585c3d3c2bb383ed80b1feaf878e
Last affected
83f33002916b0d752667a29a7fcf865af4609e7a
Last affected
89f6ce4d6813725c5102f8f2ac3be22bee482b29
Last affected
8dd758add476db0ee9a7c1abab136e30ebde01b2
Last affected
91cb5232eaceb21fe2ef176ea6b7835ed78ae185
Last affected
943f2188be659dbccc17e6082dc0c542f9debea4
Last affected
9665ec3f4ea1a372efce0dfdc3e1226ef0c49249
Last affected
9ce56d132f0d6668a108f53199cf4c6bf5d6c505
Last affected
a12b964a206748de6db6dc1da2ee16249aabafce
Last affected
a6fdb2b0bbe8c189fd212d798f71f183fd3318ba
Last affected
aafbf2cdd8dcc565ad65ff5993b6cc91da430e1e
Last affected
abdcfc1e99045bfc2a7fd5d1aaa8e9769e478952
Last affected
befb6e4bf13dd05d09ecc82054e8eb1ef68ddcf5
Last affected
c1ce7ee805ce42b0ed8be10adbad7983dbf38c6f
Last affected
c3c54b9c223a7f3bd9512b3a98dd4b95d23e3afa
Last affected
d042d99a23d9a0e7bf56cd0c4767c9ce0640ca37
Last affected
d093cdf68ec6716be445c653277f602739a5086b
Last affected
d30e647f21ecef5490f21facf2e06e228b44a36e
Last affected
d31ba9d45eb31100ea30461dd859a5a9663b1e4a
Last affected
dbe58ce9fb59913993aa2d7a5f2c28a292ee4a86
Last affected
e067b8c20a2c01c947342c4f3c625b40b08b918f
Last affected
e0c8862be83f591fc1b032045e98b96796061373
Last affected
e3813a02221fd56ec25139371411b2cd781e2c13
Last affected
e641be6dd504882bd357015c8012195d5bb49da2
Last affected
e9ebb1ed89f27827ea1963d1329b1f8335aba9ac
Last affected
efd11afe1b526bb03f59b699aaadf6a1449e0244
Last affected
f09a72320f4769dd3a8402c3805f2e47afcaf2ab
Last affected
f2c89b7483feeb0e5230960ed59ecb8edb903507
Last affected
f323d75b09d42a6313b47d9a74aae96ec66aa1f8
Last affected
fe16ceac5e47687386b4c54d2d11a28f017f4bf4

Affected versions

8.*

8.7.10
8.7.11
8.7.6
8.7.7
8.7.9
8.8.0.beta1
8.8.10
8.8.11
8.8.12
8.8.15
8.8.15.p1
8.8.15.p10
8.8.15.p11
8.8.15.p12
8.8.15.p13
8.8.15.p14
8.8.15.p15
8.8.15.p16
8.8.15.p17
8.8.15.p18
8.8.15.p2
8.8.15.p20
8.8.15.p23
8.8.15.p24
8.8.15.p25
8.8.15.p26
8.8.15.p27
8.8.15.p29
8.8.15.p3
8.8.15.p30
8.8.15.p31
8.8.15.p4
8.8.15.p5
8.8.15.p6
8.8.15.p7
8.8.15.p8
8.8.15.p9
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.8.7
8.8.8
8.8.9

9.*

9.0.0
9.0.0.p1
9.0.0.p10
9.0.0.p11
9.0.0.p13
9.0.0.p14
9.0.0.p16
9.0.0.p18
9.0.0.p19
9.0.0.p2
9.0.0.p20
9.0.0.p22
9.0.0.p23
9.0.0.p3
9.0.0.p4
9.0.0.p5
9.0.0.p6
9.0.0.p7
9.0.0.p8
9.0.0.p9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37042.json"

github.com/zimbra/zm-zcs

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-zcs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
23aed22cd8a74171216c22f113baf1c7516065a5
Last affected
6c72db05e6f1b89c511ba5c08ec4b6399bec7bb6
Last affected
7cf503e14f689f39bad171475fb4e151bfcc22ee
Last affected
962d3b31752b93f2b7f5ea2f7819b9c9d84898df
Last affected
a83bcabca58b1b719e807cbd52bdcdbea7e22f75

Affected versions

8.*

8.7.10
8.7.11
8.7.6
8.7.7
8.7.9
8.8.0.beta1
8.8.0beta2
8.8.10
8.8.11
8.8.12
8.8.15
8.8.15.p6
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.8.7
8.8.8
8.8.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37042.json"

github.com/zimbra/zm-zcs-lib

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-zcs-lib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
08274721e99c2522952c640cd42e4d0cf676d432
Last affected
08eb5d93ab2f2bc818bb1667887764bbee4f3aa9
Last affected
0ab6066136702c847b75ff6928cf5e7af37adb6f
Last affected
0dd38e39924496b68d0a2807c72de7695681993d
Last affected
27f9acd6ab9babed8fb0602875d04818f794868e
Last affected
346a8b688ae2ff67faa1290cb6695e4c3eca203c
Last affected
36c11f7361993e9519db5045990575cd11ef1f1a
Last affected
386ad1144028a914410a97f6eb1315d4a49816a8
Last affected
3b6e90df64bed3cb0aaf605381907da531613b7d
Last affected
41db44a222b547dcc89ab50273cb8684195c09c2
Last affected
44b9b3609dfba13e6e8d9dc499e0c20de536a2cd
Last affected
5be2b97e2a4b7ce10b1db69326e8affdc5d3cd24
Last affected
82f2192747ae7a6e81355ac0d2e4f02ea2e6609f
Last affected
8bcba1b06e45aab2778b1207d2b4b2eb05f9e7dd
Last affected
9b7ae9e23a972a6f0d0873fd61b7e5fb55368e3a
Last affected
9f5d7ba63f30eb333f5863f77726c596ad7798c1
Last affected
bd05dc4161a2046d2972fb744f98675fa0f5b4f0
Last affected
c038911e725cea6db549342703bfacf0c351ce50
Last affected
e4d1c37ce718e373e81bdb46c8415e3694c2470f
Last affected
f7d07af90e612dba63830d5f7babb18d7c512eb4

Affected versions

8.*

8.7.10
8.7.11
8.7.6
8.7.7
8.7.9
8.8.0.beta1
8.8.10
8.8.11
8.8.12
8.8.15
8.8.15.p3
8.8.15.p5
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.8.7
8.8.8
8.8.9

9.*

9.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37042.json"