CVE-2022-37042

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-37042
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37042.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-37042
Published
2022-08-12T15:15:16.053Z
Modified
2026-03-14T11:50:54.256063Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

References

Affected packages

Git / github.com/zimbra/zm-build

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-build
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ac6081fa002b1511e926aba37740d2b6c20f3f43
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
29eea219faf34718f0ef1cda7c3f02c89910c96c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
29eea219faf34718f0ef1cda7c3f02c89910c96c
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
62480d2f6aace77ee01bb4b8f46a3eff49cbdfd3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
71b1626efff0a90ba64ff3e5ab192683e6dccc9a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
905970576d6fe337150f09c0ad7a0f53aa1a8f42
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5ae8f73501330bc788daed9c82c1222857d85b8b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
fe985a33cb83f82816a1e8f93d8d864112a6504e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b7209ef3fd859fda5537cc7fbfdeb97cbd1ab931
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
0e40da921adb967639011de45841cef4c4601413
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
b6cd8f69d2761c014d4a3807f0bdee0011386444
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5561a39cba0898c3bb5e188284d98f498d7a3c9a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5561a39cba0898c3bb5e188284d98f498d7a3c9a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d3209df466110d214b2ab6593f931a59c2127db8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c8a93da38fd1572d864c1becbcc772ba91ee4403
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
202d83762fca70b7403c144e1fedddc6cd4930a6
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
03d99a16095b73a73770fbb6131d10234cfc13fd
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
bcb978ccc354d99d843725886083e321759b6765
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p20"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p26"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p30"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p31"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p32"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-NA"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p19"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p20"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p23"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p25"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p7"
        }
    ]
}
Type
GIT
Repo
https://github.com/zimbra/zm-mailbox
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e9ebb1ed89f27827ea1963d1329b1f8335aba9ac
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7a895cdd697874d0b3e8b8caf58aca8587370df3
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
befb6e4bf13dd05d09ecc82054e8eb1ef68ddcf5
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f2c89b7483feeb0e5230960ed59ecb8edb903507
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
91cb5232eaceb21fe2ef176ea6b7835ed78ae185
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7a1bb7c8d0dafd59a551674e52c0b472d4cf275b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
60555cd490710748f161320029fcbdfc3379adfd
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
abdcfc1e99045bfc2a7fd5d1aaa8e9769e478952
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
8dd758add476db0ee9a7c1abab136e30ebde01b2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e067b8c20a2c01c947342c4f3c625b40b08b918f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
9ce56d132f0d6668a108f53199cf4c6bf5d6c505
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
5b8551b2bfdfc49af4ef5c7ca75f9c5061635031
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e3813a02221fd56ec25139371411b2cd781e2c13
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
c1ce7ee805ce42b0ed8be10adbad7983dbf38c6f
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e0c8862be83f591fc1b032045e98b96796061373
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
efd11afe1b526bb03f59b699aaadf6a1449e0244
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d093cdf68ec6716be445c653277f602739a5086b
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a12b964a206748de6db6dc1da2ee16249aabafce
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
58996926d8f031827e03ec788d69fd2d16739b1a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
d31ba9d45eb31100ea30461dd859a5a9663b1e4a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
943f2188be659dbccc17e6082dc0c542f9debea4
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
82e2bdc9c525585c3d3c2bb383ed80b1feaf878e
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e641be6dd504882bd357015c8012195d5bb49da2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
e641be6dd504882bd357015c8012195d5bb49da2
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
52c811a0259419b4e3d177f80c0ba7562d375cfa
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
459d2044a9a205efee2b8998be41762876174dde
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
497eef64675f6ae63972c50c24e26048640748f6
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
dbe58ce9fb59913993aa2d7a5f2c28a292ee4a86
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
63c14463c4393c0fcdec4a470e448d1d7dab76d1
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
83f33002916b0d752667a29a7fcf865af4609e7a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
19ec057977b93892ef40c4d4d68b578bb8e4dea0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
4576339cd43ab64c19dc87591825ab51cb79f07a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
a6fdb2b0bbe8c189fd212d798f71f183fd3318ba
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
f323d75b09d42a6313b47d9a74aae96ec66aa1f8
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
7d74bc7bfd7f78c7261d0e52baf42716630fc3f0
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
10b7ff251aee6f4770ad75377a1f81491ad5bdb9
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p12"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p15"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p16"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p17"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p18"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p23"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p24"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p25"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p27"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p29"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p31\\.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p4"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p7"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p9"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p10"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p11"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p13"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p14"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p16"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p17"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p18"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p22"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p24"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p24\\.1"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p3"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p5"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p8"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0.0-p9"
        }
    ]
}
Type
GIT
Repo
https://github.com/zimbra/zm-zcs-lib
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
bd05dc4161a2046d2972fb744f98675fa0f5b4f0
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.8.15-p21"
        }
    ]
}

Affected versions

8.*
8.7.10
8.7.11
8.7.6
8.7.7
8.7.9
8.8.0.beta1
8.8.10
8.8.11
8.8.11.p3
8.8.12
8.8.15
8.8.15.p1
8.8.15.p10
8.8.15.p2
8.8.15.p20
8.8.15.p21
8.8.15.p3
8.8.15.p4
8.8.15.p5
8.8.15.p6
8.8.15.p7
8.8.15.p8
8.8.15.p9
8.8.2
8.8.3
8.8.4
8.8.5
8.8.6
8.8.7
8.8.8
8.8.9
8.8.9.p1
8.8.9.p3
9.*
9.0.0
9.0.0.p1
9.0.0.p10
9.0.0.p2
9.0.0.p3
9.0.0.p4
9.0.0.p5
9.0.0.p6
9.0.0.p7
9.0.0.p8
9.0.0.p9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37042.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p19"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p22"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "8.8.15-p28"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p12"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p15"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0.0-p21"
            }
        ]
    }
]