CVE-2022-37042 - CVE House
Back to Database
Status published Unknown CVE-2022-37042

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality...

Vulnerability Description

Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-37042

Credits & Attribution

No credits recorded in the NVD database.

References

More from synacor

View All →
CVE-2022-41352
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and...
Unknown 0
CVE-2022-27926
A reflected cross-site scripting (XSS) vulnerability in the /public/launchNewWindow.jsp component...
Unknown 0
CVE-2022-27925
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 has mboximport functionality...
Unknown 0
CVE-2022-27924
Zimbra Collaboration (aka ZCS) 8.8.15 and 9.0 allows an unauthenticated...
Unknown 0
CVE-2022-24682
An issue was discovered in the Calendar feature in Zimbra...
Unknown 0

Affected Vendor

Affected Software

zimbra collaboration suite
Vulnerable Versions:
8.8.15, 9.0.0

Timeline

Official Publish: August 11th, 2022
Last Modified: October 21st, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.