CVE-2024-45519

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 8.8.15 Patch 46 Zimbra Collaboration Suite versions prior to 9.0.0 Patch 41 Zimbra Collaboration Suite versions prior to 10.0.9 Zimbra Collaboration Suite versions prior to 10.1.1

Description The postjournal service in Zimbra Collaboration Suite fails to properly neutralize special elements used in operating system commands. This allows unauthenticated remote attackers to execute arbitrary commands via crafted SMTP requests. Attackers have been observed spoofing Gmail addresses and using the RCPT TO field to inject commands, enabling the creation of web shells, privilege escalation, and lateral movement within the email infrastructure to exfiltrate organizational intelligence, contacts, and internal communications. In some environments, over 3,000 unique IP addresses were identified as potential targets due to missing security updates.

Recommendations Update Zimbra Collaboration Suite to version 8.8.15 Patch 46 or later. Update Zimbra Collaboration Suite to version 9.0.0 Patch 41 or later. Update Zimbra Collaboration Suite to version 10.0.9 or later. Update Zimbra Collaboration Suite to version 10.1.1 or later. As a temporary mitigation, restrict access to the postjournal service on port 10027.