CVE-2022-37393

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-37393

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37393.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-37393

Published

2022-08-16T20:00:19.211Z

Modified

2026-07-15T01:49:18.359513610Z

Summary

Zimbra zmslapd arbitrary module load

Details

Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "9.0.0.p27"
                },
                {
                    "last_affected": "9.0.0.p27"
                },
                {
                    "introduced": "8.8.15.p34"
                },
                {
                    "last_affected": "8.8.15.p34"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-284"
    ],
    "cna_assigner": "rapid7",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37393.json"
}

References

Affected packages

Git / github.com/zimbra/zm-build

Affected ranges

Type

GIT

Repo

https://github.com/zimbra/zm-build

Events

Introduced

ecfce091cf6203d60de6b38f70570792a3877c08

Last affected

b20d016c829af1c0ffbaa0545c1deb96ccd5e2e5

Database specific

{
    "cpe": [
        "cpe:2.3:a:zimbra:collaboration:8.7.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.10:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p10:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p11:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p12:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p13:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p14:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p15:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p2:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p3:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p4:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p5:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p6:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p7:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p8:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.7.11:p9:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.8:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.8:p1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.8:p3:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.8:p4:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.8:p7:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.9:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.9:p1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.9:p3:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.9:p10:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.10:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.10:p8:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.11:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.11:p3:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.11:p4:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.11:p5:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.12:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.12:p3:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.12:p4:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p26:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p3:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p30:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p31:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p32:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p33:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p34:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p5:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "8.7.6"
        },
        {
            "last_affected": "8.7.6"
        },
        {
            "introduced": "8.7.7"
        },
        {
            "last_affected": "8.7.7"
        },
        {
            "introduced": "8.7.9"
        },
        {
            "last_affected": "8.7.9"
        },
        {
            "introduced": "8.7.10"
        },
        {
            "last_affected": "8.7.10"
        },
        {
            "introduced": "8.7.11-NA"
        },
        {
            "last_affected": "8.7.11-NA"
        },
        {
            "introduced": "8.7.11-p1"
        },
        {
            "last_affected": "8.7.11-p1"
        },
        {
            "introduced": "8.7.11-p10"
        },
        {
            "last_affected": "8.7.11-p10"
        },
        {
            "introduced": "8.7.11-p11"
        },
        {
            "last_affected": "8.7.11-p11"
        },
        {
            "introduced": "8.7.11-p12"
        },
        {
            "last_affected": "8.7.11-p12"
        },
        {
            "introduced": "8.7.11-p13"
        },
        {
            "last_affected": "8.7.11-p13"
        },
        {
            "introduced": "8.7.11-p14"
        },
        {
            "last_affected": "8.7.11-p14"
        },
        {
            "introduced": "8.7.11-p15"
        },
        {
            "last_affected": "8.7.11-p15"
        },
        {
            "introduced": "8.7.11-p2"
        },
        {
            "last_affected": "8.7.11-p2"
        },
        {
            "introduced": "8.7.11-p3"
        },
        {
            "last_affected": "8.7.11-p3"
        },
        {
            "introduced": "8.7.11-p4"
        },
        {
            "last_affected": "8.7.11-p4"
        },
        {
            "introduced": "8.7.11-p5"
        },
        {
            "last_affected": "8.7.11-p5"
        },
        {
            "introduced": "8.7.11-p6"
        },
        {
            "last_affected": "8.7.11-p6"
        },
        {
            "introduced": "8.7.11-p7"
        },
        {
            "last_affected": "8.7.11-p7"
        },
        {
            "introduced": "8.7.11-p8"
        },
        {
            "last_affected": "8.7.11-p8"
        },
        {
            "introduced": "8.7.11-p9"
        },
        {
            "last_affected": "8.7.11-p9"
        },
        {
            "introduced": "8.8.0-beta1"
        },
        {
            "last_affected": "8.8.0-beta1"
        },
        {
            "introduced": "8.8.2"
        },
        {
            "last_affected": "8.8.2"
        },
        {
            "introduced": "8.8.3"
        },
        {
            "last_affected": "8.8.3"
        },
        {
            "introduced": "8.8.4"
        },
        {
            "last_affected": "8.8.4"
        },
        {
            "introduced": "8.8.6"
        },
        {
            "last_affected": "8.8.6"
        },
        {
            "introduced": "8.8.7"
        },
        {
            "last_affected": "8.8.7"
        },
        {
            "introduced": "8.8.8-NA"
        },
        {
            "last_affected": "8.8.8-NA"
        },
        {
            "introduced": "8.8.8-p1"
        },
        {
            "last_affected": "8.8.8-p1"
        },
        {
            "introduced": "8.8.8-p3"
        },
        {
            "last_affected": "8.8.8-p3"
        },
        {
            "introduced": "8.8.8-p4"
        },
        {
            "last_affected": "8.8.8-p4"
        },
        {
            "introduced": "8.8.8-p7"
        },
        {
            "last_affected": "8.8.8-p7"
        },
        {
            "introduced": "8.8.9-NA"
        },
        {
            "last_affected": "8.8.9-NA"
        },
        {
            "introduced": "8.8.9-p1"
        },
        {
            "last_affected": "8.8.9-p1"
        },
        {
            "introduced": "8.8.9-p3"
        },
        {
            "last_affected": "8.8.9-p3"
        },
        {
            "introduced": "8.8.9-p10"
        },
        {
            "last_affected": "8.8.9-p10"
        },
        {
            "introduced": "8.8.10-NA"
        },
        {
            "last_affected": "8.8.10-NA"
        },
        {
            "introduced": "8.8.10-p8"
        },
        {
            "last_affected": "8.8.10-p8"
        },
        {
            "introduced": "8.8.11-NA"
        },
        {
            "last_affected": "8.8.11-NA"
        },
        {
            "introduced": "8.8.11-p3"
        },
        {
            "last_affected": "8.8.11-p3"
        },
        {
            "introduced": "8.8.11-p4"
        },
        {
            "last_affected": "8.8.11-p4"
        },
        {
            "introduced": "8.8.11-p5"
        },
        {
            "last_affected": "8.8.11-p5"
        },
        {
            "introduced": "8.8.12-NA"
        },
        {
            "last_affected": "8.8.12-NA"
        },
        {
            "introduced": "8.8.12-p3"
        },
        {
            "last_affected": "8.8.12-p3"
        },
        {
            "introduced": "8.8.12-p4"
        },
        {
            "last_affected": "8.8.12-p4"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p11"
        },
        {
            "last_affected": "8.8.15-p11"
        },
        {
            "introduced": "8.8.15-p26"
        },
        {
            "last_affected": "8.8.15-p26"
        },
        {
            "introduced": "8.8.15-p3"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "8.8.15-p30"
        },
        {
            "last_affected": "8.8.15-p30"
        },
        {
            "introduced": "8.8.15-p31"
        },
        {
            "last_affected": "8.8.15-p31"
        },
        {
            "introduced": "8.8.15-p32"
        },
        {
            "last_affected": "8.8.15-p32"
        },
        {
            "introduced": "8.8.15-p33"
        },
        {
            "last_affected": "8.8.15-p33"
        },
        {
            "introduced": "8.8.15-p34"
        },
        {
            "last_affected": "8.8.15-p34"
        },
        {
            "introduced": "8.8.15-p5"
        },
        {
            "last_affected": "8.8.15-p5"
        },
        {
            "introduced": "9.0.0-p0"
        },
        {
            "last_affected": "9.0.0-p0"
        },
        {
            "introduced": "9.0.0-p19"
        },
        {
            "last_affected": "9.0.0-p19"
        },
        {
            "introduced": "9.0.0-p23"
        },
        {
            "last_affected": "9.0.0-p23"
        },
        {
            "introduced": "9.0.0-p25"
        },
        {
            "last_affected": "9.0.0-p25"
        },
        {
            "introduced": "9.0.0-p26"
        },
        {
            "last_affected": "9.0.0-p26"
        },
        {
            "introduced": "9.0.0-p27"
        },
        {
            "last_affected": "9.0.0-p27"
        },
        {
            "introduced": "9.0.0-p4"
        },
        {
            "last_affected": "9.0.0-p4"
        },
        {
            "introduced": "9.0.0-p7"
        },
        {
            "last_affected": "9.0.0-p7"
        },
        {
            "introduced": "9.0.0-p7\\.1"
        },
        {
            "last_affected": "9.0.0-p7\\.1"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

8.*

8.7.10

8.7.11

8.7.11-NA

8.7.11-p1

8.7.11-p10

8.7.11-p11

8.7.11-p12

8.7.11-p13

8.7.11-p14

8.7.11-p15

8.7.11-p2

8.7.11-p3

8.7.11-p4

8.7.11-p5

8.7.11-p6

8.7.11-p7

8.7.11-p8

8.7.11-p9

8.7.6

8.7.7

8.7.9

8.8.0-beta1

8.8.0.beta1

8.8.10

8.8.10-NA

8.8.10-p8

8.8.11-NA

8.8.11-p4

8.8.11-p5

8.8.12

8.8.12-NA

8.8.12-p3

8.8.12-p4

8.8.15-NA

8.8.15-p11

8.8.15-p26

8.8.15-p3

8.8.15-p30

8.8.15-p31

8.8.15-p32

8.8.15-p33

8.8.15-p34

8.8.15-p5

8.8.2

8.8.3

8.8.4

8.8.6

8.8.7

8.8.8

8.8.8-NA

8.8.8-p1

8.8.9

8.8.9-NA

8.8.9-p10

8.8.9.p1

8.8.9.p3

9.*

9.0.0

9.0.0-p0

9.0.0-p19

9.0.0-p23

9.0.0-p25

9.0.0-p26

9.0.0-p27

9.0.0-p4

9.0.0-p7

9.0.0-p7\.1

9.0.0.p4

9.0.0.p7

9.0.0.p7.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37393.json"