CVE-2024-45519 | The postjournal service in Zimbra Collaboration (ZCS) before… | CVSS 10.0 CRITICAL

Description

The postjournal service in Zimbra Collaboration (ZCS) before 8.8.15 Patch 46, 9 before 9.0.0 Patch 41, 10 before 10.0.9, and 10.1 before 10.1.1 sometimes allows unauthenticated users to execute commands.

Metadata

CVE ID: CVE-2024-45519
State: PUBLISHED
Assigner: mitre
Reserved: 2024-09-01 00:00 UTC
Published: 2024-10-02 00:00 UTC
Last updated: 2026-02-03 19:27 UTC
Primary CWE: CWE-78
CWE-78 Improper Neutralization of Special Elements used in a…
Vendor / Product: n/a / n/a
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

SSVC — CISA Coordinator

Exploitation: ACTIVE
Automatable: yes
Tech. Impact: total

CISA Known Exploited Vulnerability

Vulnerability name: Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability
Vendor: Synacor
Product: Zimbra Collaboration Suite (ZCS)
Added to KEV: 2024-10-03
Due date: 2024-10-24
Ransomware: Not known

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA description

Synacor Zimbra Collaboration Suite (ZCS) contains an unspecified vulnerability in the postjournal service that may allow an unauthenticated user to execute commands.

Affected products (1)

Vendor	Product	Platform	Versions
n/a	n/a	—	n/a

Weakness (CWE)

CWE	Source	Description
—	cna	n/a
CWE-78	adp	CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	3.1	cna	CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

References (6)