CVE-2022-41352
An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to /opt/zimbra/jetty/webapps/zimbra/public) that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also, pax is in the prerequisites of Zimbra on Ubuntu; however, pax is no longer part of a default Red Hat installation after RHEL 6 (or CentOS 6). Once pax is installed, amavis automatically prefers it over cpio.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Oct 20, 2022
- US federal agencies must remediate it by Nov 10, 2022 (BOD 22-01)
- First attack observed 24 days after disclosure
- Used in ransomware campaigns
Apply updates per vendor instructions.
Source: CISA KEV · Jun 19, 2025 Feb 25, 2025 Feb 20, 2025 Feb 12, 2025 Jul 25, 2024 Jul 18, 2024
CVSS score9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-22, CWE-22
Vendorssynacor
Affected products
| Vendors | Product | Versions |
|---|---|---|
| synacor | zimbra collaboration suite | 9.0.0 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.