CVE-2022-37393
- Source
- https://cve.org/CVERecord?id=CVE-2022-37393
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37393.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-37393
- Published
- 2022-08-16T20:00:19Z
- Modified
- 2026-10-21T02:48:00Z
- Summary
- Zimbra zmslapd arbitrary module load
- Details
-
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
- Database specific
{ "cna_assigner": "rapid7", "cwe_ids": [ "CWE-284" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37393.json", "unresolved_ranges": [ { "extracted_events": [ { "range": [ { "introduced": "9.0.0.p27" }, { "last_affected": "9.0.0.p27" }, { "introduced": "8.8.15.p34" }, { "last_affected": "8.8.15.p34" } ], "source": "AFFECTED_FIELD", "strategy": "StandaloneSingleVersion" } ] } ] }- References
-
- https://attackerkb.com/topics/92AeLOE1M1/cve-2022-37393/rapid7-analysis
- https://darrenmartyn.ie/2021/10/27/zimbra-zmslapd-local-root-exploit/
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37393.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-37393
- https://github.com/rapid7/metasploit-framework/pull/16807
Affected packages
Git / github.com/zimbra/zm-build
Affected ranges
- Type
- GIT
- Repo
- https://github.com/zimbra/zm-build
- Events
-
IntroducedLast Affected
- Database specific
-
Show details
{ "extracted_events": [ { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.6:*:*:*:*:*:*:*", "range": [ { "introduced": "8.7.6" }, { "last_affected": "8.7.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.7:*:*:*:*:*:*:*", "range": [ { "introduced": "8.7.7" }, { "last_affected": "8.7.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.9:*:*:*:*:*:*:*", "range": [ { "introduced": "8.7.9" }, { "last_affected": "8.7.9" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.10:*:*:*:*:*:*:*", "range": [ { "introduced": "8.7.10" }, { "last_affected": "8.7.10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:-:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-NA" }, { "last_affected": "8.7.11-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p1:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p1" }, { "last_affected": "8.7.11-p1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p10:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p10" }, { "last_affected": "8.7.11-p10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p11:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p11" }, { "last_affected": "8.7.11-p11" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p12:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p12" }, { "last_affected": "8.7.11-p12" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p13:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p13" }, { "last_affected": "8.7.11-p13" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p14:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p14" }, { "last_affected": "8.7.11-p14" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p15:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p15" }, { "last_affected": "8.7.11-p15" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p2:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p2" }, { "last_affected": "8.7.11-p2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p3:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p3" }, { "last_affected": "8.7.11-p3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p4:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p4" }, { "last_affected": "8.7.11-p4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p5:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p5" }, { "last_affected": "8.7.11-p5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p6:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p6" }, { "last_affected": "8.7.11-p6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p7:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p7" }, { "last_affected": "8.7.11-p7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p8:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p8" }, { "last_affected": "8.7.11-p8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.7.11:p9:*:*:*:*:*:*", "range": [ { "introduced": "8.7.11-p9" }, { "last_affected": "8.7.11-p9" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.0:beta1:*:*:*:*:*:*", "range": [ { "introduced": "8.8.0-beta1" }, { "last_affected": "8.8.0-beta1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.2:*:*:*:*:*:*:*", "range": [ { "introduced": "8.8.2" }, { "last_affected": "8.8.2" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.3:*:*:*:*:*:*:*", "range": [ { "introduced": "8.8.3" }, { "last_affected": "8.8.3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.4:*:*:*:*:*:*:*", "range": [ { "introduced": "8.8.4" }, { "last_affected": "8.8.4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.6:*:*:*:*:*:*:*", "range": [ { "introduced": "8.8.6" }, { "last_affected": "8.8.6" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.7:*:*:*:*:*:*:*", "range": [ { "introduced": "8.8.7" }, { "last_affected": "8.8.7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.8:-:*:*:*:*:*:*", "range": [ { "introduced": "8.8.8-NA" }, { "last_affected": "8.8.8-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.8:p1:*:*:*:*:*:*", "range": [ { "introduced": "8.8.8-p1" }, { "last_affected": "8.8.8-p1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.8:p3:*:*:*:*:*:*", "range": [ { "introduced": "8.8.8-p3" }, { "last_affected": "8.8.8-p3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.8:p4:*:*:*:*:*:*", "range": [ { "introduced": "8.8.8-p4" }, { "last_affected": "8.8.8-p4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.8:p7:*:*:*:*:*:*", "range": [ { "introduced": "8.8.8-p7" }, { "last_affected": "8.8.8-p7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.9:-:*:*:*:*:*:*", "range": [ { "introduced": "8.8.9-NA" }, { "last_affected": "8.8.9-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.9:p1:*:*:*:*:*:*", "range": [ { "introduced": "8.8.9-p1" }, { "last_affected": "8.8.9-p1" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.9:p3:*:*:*:*:*:*", "range": [ { "introduced": "8.8.9-p3" }, { "last_affected": "8.8.9-p3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.9:p10:*:*:*:*:*:*", "range": [ { "introduced": "8.8.9-p10" }, { "last_affected": "8.8.9-p10" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.10:-:*:*:*:*:*:*", "range": [ { "introduced": "8.8.10-NA" }, { "last_affected": "8.8.10-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.10:p8:*:*:*:*:*:*", "range": [ { "introduced": "8.8.10-p8" }, { "last_affected": "8.8.10-p8" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.11:-:*:*:*:*:*:*", "range": [ { "introduced": "8.8.11-NA" }, { "last_affected": "8.8.11-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.11:p3:*:*:*:*:*:*", "range": [ { "introduced": "8.8.11-p3" }, { "last_affected": "8.8.11-p3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.11:p4:*:*:*:*:*:*", "range": [ { "introduced": "8.8.11-p4" }, { "last_affected": "8.8.11-p4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.11:p5:*:*:*:*:*:*", "range": [ { "introduced": "8.8.11-p5" }, { "last_affected": "8.8.11-p5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.12:-:*:*:*:*:*:*", "range": [ { "introduced": "8.8.12-NA" }, { "last_affected": "8.8.12-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.12:p3:*:*:*:*:*:*", "range": [ { "introduced": "8.8.12-p3" }, { "last_affected": "8.8.12-p3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.12:p4:*:*:*:*:*:*", "range": [ { "introduced": "8.8.12-p4" }, { "last_affected": "8.8.12-p4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*", "range": [ { "introduced": "8.8.15-NA" }, { "last_affected": "8.8.15-NA" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:*", "range": [ { "introduced": "8.8.15-p11" }, { "last_affected": "8.8.15-p11" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.15:p26:*:*:*:*:*:*", "range": [ { "introduced": "8.8.15-p26" }, { "last_affected": "8.8.15-p26" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.15:p3:*:*:*:*:*:*", "range": [ { "introduced": "8.8.15-p3" }, { "last_affected": "8.8.15-p3" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.15:p30:*:*:*:*:*:*", "range": [ { "introduced": "8.8.15-p30" }, { "last_affected": "8.8.15-p30" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.15:p31:*:*:*:*:*:*", "range": [ { "introduced": "8.8.15-p31" }, { "last_affected": "8.8.15-p31" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.15:p32:*:*:*:*:*:*", "range": [ { "introduced": "8.8.15-p32" }, { "last_affected": "8.8.15-p32" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.15:p33:*:*:*:*:*:*", "range": [ { "introduced": "8.8.15-p33" }, { "last_affected": "8.8.15-p33" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.15:p34:*:*:*:*:*:*", "range": [ { "introduced": "8.8.15-p34" }, { "last_affected": "8.8.15-p34" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:8.8.15:p5:*:*:*:*:*:*", "range": [ { "introduced": "8.8.15-p5" }, { "last_affected": "8.8.15-p5" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*", "range": [ { "introduced": "9.0.0-p0" }, { "last_affected": "9.0.0-p0" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*", "range": [ { "introduced": "9.0.0-p19" }, { "last_affected": "9.0.0-p19" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*", "range": [ { "introduced": "9.0.0-p23" }, { "last_affected": "9.0.0-p23" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*", "range": [ { "introduced": "9.0.0-p25" }, { "last_affected": "9.0.0-p25" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*", "range": [ { "introduced": "9.0.0-p26" }, { "last_affected": "9.0.0-p26" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*", "range": [ { "introduced": "9.0.0-p27" }, { "last_affected": "9.0.0-p27" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*", "range": [ { "introduced": "9.0.0-p4" }, { "last_affected": "9.0.0-p4" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*", "range": [ { "introduced": "9.0.0-p7" }, { "last_affected": "9.0.0-p7" } ], "source": "CPE_STRING" }, { "cpe": "cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*", "range": [ { "introduced": "9.0.0-p7\\.1" }, { "last_affected": "9.0.0-p7\\.1" } ], "source": "CPE_STRING" } ] }
Affected versions
8.*
8.7.10
8.7.11
8.7.11-NA
8.7.11-p1
8.7.11-p10
8.7.11-p11
8.7.11-p12
8.7.11-p13
8.7.11-p14
8.7.11-p15
8.7.11-p2
8.7.11-p3
8.7.11-p4
8.7.11-p5
8.7.11-p6
8.7.11-p7
8.7.11-p8
8.7.11-p9
8.7.6
8.7.7
8.7.9
8.8.0-beta1
8.8.0.beta1
8.8.10
8.8.10-NA
8.8.10-p8
8.8.11-NA
8.8.11-p4
8.8.11-p5
8.8.12
8.8.12-NA
8.8.12-p3
8.8.12-p4
8.8.15-NA
8.8.15-p11
8.8.15-p26
8.8.15-p3
8.8.15-p30
8.8.15-p31
8.8.15-p32
8.8.15-p33
8.8.15-p34
8.8.15-p5
8.8.2
8.8.3
8.8.4
8.8.6
8.8.7
8.8.8
8.8.8-NA
8.8.8-p1
8.8.9
8.8.9-NA
8.8.9-p10
8.8.9.p1
8.8.9.p3
9.*
9.0.0
9.0.0-p0
9.0.0-p19
9.0.0-p23
9.0.0-p25
9.0.0-p26
9.0.0-p27
9.0.0-p4
9.0.0-p7
9.0.0-p7\.1
9.0.0.p4
9.0.0.p7
9.0.0.p7.1