Vulnerability Details : CVE-2022-41347
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
Products affected by CVE-2022-41347
- cpe:2.3:a:zimbra:collaboration:8.8.15:-:*:*:*:*:*:*
- cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-41347
0.09%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 38 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-41347
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.8
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
References for CVE-2022-41347
-
https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
Zimbra Security Advisories - Zimbra :: Tech CenterVendor Advisory
-
https://wiki.zimbra.com/wiki/Security_Center
Security Center - Zimbra :: Tech CenterPatch;Vendor Advisory
-
https://github.com/darrenmartyn/zimbra-hinginx
GitHub - darrenmartyn/zimbra-hinginx: zimbra nginx lpe exploitThird Party Advisory
-
https://darrenmartyn.ie/2021/10/25/zimbra-nginx-local-root-exploit/
Zimbra “nginx” Local Root Exploit – Darren MartynExploit;Third Party Advisory
Jump to