CVE-2024-45518

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-45518
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45518.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-45518
Published
2024-10-22T00:00:00Z
Modified
2026-07-08T07:57:38.893561750Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An issue was discovered in Zimbra Collaboration (ZCS) 10.1.x before 10.1.1, 10.0.x before 10.0.9, 9.0.0 before Patch 41, and 8.8.15 before Patch 46. It allows authenticated users to exploit Server-Side Request Forgery (SSRF) due to improper input sanitization and misconfigured domain whitelisting. This issue permits unauthorized HTTP requests to be sent to internal services, which can lead to Remote Code Execution (RCE) by chaining Command Injection within the internal service. When combined with existing XSS vulnerabilities, this SSRF issue can further facilitate Remote Code Execution (RCE).

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "DESCRIPTION",
            "extracted_events": [
                {
                    "introduced": "10.1.x"
                },
                {
                    "fixed": "10.1.1"
                },
                {
                    "introduced": "10.0.x"
                },
                {
                    "fixed": "10.0.9"
                },
                {
                    "introduced": "9.0.0"
                },
                {
                    "introduced": "8.8.15"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/45xxx/CVE-2024-45518.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/zimbra/zm-build

Affected ranges

Type
GIT
Repo
https://github.com/zimbra/zm-build
Events
Introduced
b68c7b31a1d94f94903a79c53f1bd316b792de1d
Fixed
2c67cbdfaebf6a71928749b7146f4852876b63ff
Introduced
ac6081fa002b1511e926aba37740d2b6c20f3f43
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "cpe": [
        "cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p11:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p20:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p26:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p3:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p30:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p31:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p32:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p33:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p34:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p35:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p40:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p43:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p44:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p45:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:8.8.15:p5:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*",
        "cpe:2.3:a:zimbra:collaboration:10.1.0:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.0.9"
        },
        {
            "introduced": "8.8.15-NA"
        },
        {
            "last_affected": "8.8.15-NA"
        },
        {
            "introduced": "8.8.15-p1"
        },
        {
            "last_affected": "8.8.15-p1"
        },
        {
            "introduced": "8.8.15-p11"
        },
        {
            "last_affected": "8.8.15-p11"
        },
        {
            "introduced": "8.8.15-p20"
        },
        {
            "last_affected": "8.8.15-p20"
        },
        {
            "introduced": "8.8.15-p26"
        },
        {
            "last_affected": "8.8.15-p26"
        },
        {
            "introduced": "8.8.15-p3"
        },
        {
            "last_affected": "8.8.15-p3"
        },
        {
            "introduced": "8.8.15-p30"
        },
        {
            "last_affected": "8.8.15-p30"
        },
        {
            "introduced": "8.8.15-p31"
        },
        {
            "last_affected": "8.8.15-p31"
        },
        {
            "introduced": "8.8.15-p32"
        },
        {
            "last_affected": "8.8.15-p32"
        },
        {
            "introduced": "8.8.15-p33"
        },
        {
            "last_affected": "8.8.15-p33"
        },
        {
            "introduced": "8.8.15-p34"
        },
        {
            "last_affected": "8.8.15-p34"
        },
        {
            "introduced": "8.8.15-p35"
        },
        {
            "last_affected": "8.8.15-p35"
        },
        {
            "introduced": "8.8.15-p40"
        },
        {
            "last_affected": "8.8.15-p40"
        },
        {
            "introduced": "8.8.15-p43"
        },
        {
            "last_affected": "8.8.15-p43"
        },
        {
            "introduced": "8.8.15-p44"
        },
        {
            "last_affected": "8.8.15-p44"
        },
        {
            "introduced": "8.8.15-p45"
        },
        {
            "last_affected": "8.8.15-p45"
        },
        {
            "introduced": "8.8.15-p5"
        },
        {
            "last_affected": "8.8.15-p5"
        },
        {
            "introduced": "9.0.0-NA"
        },
        {
            "last_affected": "9.0.0-NA"
        },
        {
            "introduced": "9.0.0-p0"
        },
        {
            "last_affected": "9.0.0-p0"
        },
        {
            "introduced": "9.0.0-p1"
        },
        {
            "last_affected": "9.0.0-p1"
        },
        {
            "introduced": "9.0.0-p19"
        },
        {
            "last_affected": "9.0.0-p19"
        },
        {
            "introduced": "9.0.0-p20"
        },
        {
            "last_affected": "9.0.0-p20"
        },
        {
            "introduced": "9.0.0-p23"
        },
        {
            "last_affected": "9.0.0-p23"
        },
        {
            "introduced": "9.0.0-p25"
        },
        {
            "last_affected": "9.0.0-p25"
        },
        {
            "introduced": "9.0.0-p26"
        },
        {
            "last_affected": "9.0.0-p26"
        },
        {
            "introduced": "9.0.0-p27"
        },
        {
            "last_affected": "9.0.0-p27"
        },
        {
            "introduced": "9.0.0-p33"
        },
        {
            "last_affected": "9.0.0-p33"
        },
        {
            "introduced": "9.0.0-p36"
        },
        {
            "last_affected": "9.0.0-p36"
        },
        {
            "introduced": "9.0.0-p37"
        },
        {
            "last_affected": "9.0.0-p37"
        },
        {
            "introduced": "9.0.0-p38"
        },
        {
            "last_affected": "9.0.0-p38"
        },
        {
            "introduced": "9.0.0-p4"
        },
        {
            "last_affected": "9.0.0-p4"
        },
        {
            "introduced": "9.0.0-p7"
        },
        {
            "last_affected": "9.0.0-p7"
        },
        {
            "introduced": "9.0.0-p7\\.1"
        },
        {
            "last_affected": "9.0.0-p7\\.1"
        },
        {
            "introduced": "10.1.0"
        },
        {
            "last_affected": "10.1.0"
        }
    ]
}

Affected versions

10.*
10.0.0-GA
10.0.1
10.0.4
10.0.5
10.0.6
10.1.0
8.*
8.8.15-NA
8.8.15-p1
8.8.15-p20
8.8.15-p26
8.8.15-p3
8.8.15-p30
8.8.15-p31
8.8.15-p32
8.8.15-p33
8.8.15-p34
8.8.15-p35
8.8.15-p40
8.8.15-p43
8.8.15-p44
8.8.15-p45
8.8.15-p5
9.*
9.0.0-NA
9.0.0-p0
9.0.0-p1
9.0.0-p20
9.0.0-p23
9.0.0-p25
9.0.0-p26
9.0.0-p27
9.0.0-p33
9.0.0-p36
9.0.0-p37
9.0.0-p38
9.0.0-p4
9.0.0-p7
9.0.0-p7\.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-45518.json"