Sequretek Advisory - Zimbra Vulnerability Patch
10/27/2022

Zimbra has released updates to address a critical code execution vulnerability that is being actively exploited. The vulnerability, CVE-2022- 41352, affects the Amavis open-source content filter component of Zimbra Collaboration Suite versions 8.8.15 and 9.0.

• Zimbra, a messaging and collaboration software maker, has provided patch for a code execution flaw that has already been exploited to launch malware on target machines.

• The vulnerability, tracked as CVE-2022-41352, was identified in September, allows an attacker to launch a shell in the web root and achieve remote code execution.

• CVE-2022-41352 allows an attacker can upload arbitrary files through amavisd via a cpio loophole that can lead to incorrect access to any other user accounts.

• The bug carries a CVSS of 9.8/10

Sign Up Here for Download