{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-27925/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-27925/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-27925/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-27925/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-27925/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-27925"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-27925"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2022/CVE-2022-27925.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2022-27925\n\ninfo:\n  name: Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal\n  author: popy21\n  severity: high\n  description: |\n    Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. An authenticated user with administrator rights has the ability to upload arbitrary files to the system, leading to directory traversal.\n  impact: |\n    An administrator-authenticated attacker uploads a ZIP whose entries traverse out of the extraction directory, dropping a JSP webshell into the Zimbra webroot for remote code execution as the zimbra user - and CVE-2022-37042 removes the authentication requirement entirely, which is how this pair was mass-exploited in the wild.\n  remediation: |\n    Apply Zimbra Collaboration 8.8.15 Patch 31 or 9.0.0 Patch 24 (both released 2022-03-30) or later, which also requires the CVE-2022-37042 fix in 8.8.15 Patch 33 / 9.0.0 Patch 26 to close the authentication bypass on the same mboximport endpoint.\n  reference:\n    - http://packetstormsecurity.com/files/168146/Zimbra-Zip-Path-Traversal.html\n    - https://wiki.zimbra.com/wiki/Security_Center\n    - https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P24\n    - https://wiki.zimbra.com/wiki/Zimbra_Releases/8.8.15/P31\n    - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories\n    - https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-27925\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 7.2\n    cve-id: CVE-2022-27925\n    cwe-id: CWE-22\n    epss-score: 0.98676\n    epss-percentile: 0.99924\n    cpe: cpe:2.3:a:synacor:zimbra_collaboration_suite:8.8.15:-:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: synacor\n    product: zimbra_collaboration_suite\n    shodan-query: http.title:\"Zimbra Collaboration Suite\"\n    fofa-query: title=\"Zimbra Collaboration Suite\"\n  tags: cve,cve2022,synacor,zimbra,zimbra-collaboration-suite,lfi,rce,kev,vkev,passive\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/js/zimbraMail/share/model/ZmSettings.js\"\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Zimbra Collaboration Suite Web Client\"\n\n      - type: word\n        part: header\n        words:\n          - \"application/x-javascript\"\n\n      - type: word\n        part: version\n        words:\n          - \"8.8.15\"\n          - \"9.0\"\n\n      - type: status\n        status:\n          - 200\n\n    extractors:\n      - type: regex\n        name: version\n        part: body\n        group: 1\n        regex:\n          - 'CLIENT_VERSION\\\",\\s+{type:ZmSetting.T_CONFIG, defaultValue:\\\"(.*?)\"'\n# digest: 4a0a00473045022046a485b5822f0d8f4504b254645a7b3424da0101dd990681963718fdc1dd16f9022100cc25c2901e97dae907a46e16788440cd7dea319491ed799423963092cccf2e9d:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2022-27925"
}