{"id":"CVE-2019-9621","published":"2019-04-30T18:29:08Z","modified":"2026-06-17T02:44:03Z","title":"Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) Vulnerability","vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","tier":"core","eol":null,"description":{"text":"Zimbra Collaboration Suite before 8.6 patch 13, 8.7.x before 8.7.11 patch 10, and 8.8.x before 8.8.10 patch 7 or 8.8.x before 8.8.11 patch 3 allows SSRF via the ProxyServlet component.","provenance":"source","from":"NVD"},"summary":{"text":"A server-side request forgery flaw in the ProxyServlet component of Synacor's Zimbra Collaboration Suite (ZCS) affects the 8.6, 8.7.x and 8.8.x release lines before their respective patches. An attacker who can reach the server over the network, without authentication or user interaction, can make it issue requests to destinations of their choosing, which can expose confidential information.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T04:54:42Z"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.81037,"percentile":0.99631,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-07-07","dueDate":"2025-07-28","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories ; https://wiki.zimbra.com/wiki/Security_Center ; https://nvd.nist.gov/vuln/detail/CVE-2019-9621","provenance":"source"},"vulncheckKev":{"dateAdded":"2023-09-18","exploitedFirstSeen":"2023-09-18","ransomware":false,"evidence":[{"url":"https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html","date":"2023-09-18"},{"url":"https://ics-cert.kaspersky.com/publications/reports/2025/03/25/apt-and-financial-attacks-on-industrial-organizations-in-q4-2024/","date":"2025-03-25"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-07-07"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"},{"id":"CWE-807","name":"Reliance on Untrusted Inputs in a Security Decision"}],"references":[{"url":"http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce","tags":["Exploit","Third Party Advisory"]},{"url":"https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html","tags":["Third Party Advisory"]},{"url":"https://blog.zimbra.com/2019/03/9826/","tags":["Vendor Advisory"]},{"url":"https://bugzilla.zimbra.com/show_bug.cgi?id=109127","tags":["Issue Tracking"]},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Release Notes","Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46693/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce","tags":["Exploit","Third Party Advisory"]},{"url":"https://blog.tint0.com/2019/03/a-saga-of-code-executions-on-zimbra.html","tags":["Third Party Advisory"]},{"url":"https://blog.zimbra.com/2019/03/9826/","tags":["Vendor Advisory"]},{"url":"https://bugzilla.zimbra.com/show_bug.cgi?id=109127","tags":["Issue Tracking"]},{"url":"https://wiki.zimbra.com/wiki/Security_Center","tags":["Release Notes","Vendor Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46693/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9621","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated SSRF against public-facing mail app","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows SSRF via the ProxyServlet component","start":141,"end":183}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1090","name":"Proxy","tactics":["command-and-control"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Server proxies attacker requests to internal resources","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows SSRF via the ProxyServlet component","start":141,"end":183}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-18992","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-18992","exploited":true,"exploitedSince":"2025-07-07","provenance":"source"},"exploits":[{"id":46693,"url":"https://www.exploit-db.com/exploits/46693","title":"Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)","type":"remote","platform":"linux","date":"2019-04-12","verified":true,"provenance":"source"},{"id":46693,"url":"https://www.exploit-db.com/exploits/46693","title":"Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)","type":"remote","platform":"linux","date":"2019-04-12","verified":true,"provenance":"source"},{"id":46693,"url":"https://www.exploit-db.com/exploits/46693","title":"Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)","type":"remote","platform":"linux","date":"2019-04-12","verified":true,"provenance":"source"},{"id":46693,"url":"https://www.exploit-db.com/exploits/46693","title":"Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)","type":"remote","platform":"linux","date":"2019-04-12","verified":true,"provenance":"source"},{"id":46967,"url":"https://www.exploit-db.com/exploits/46967","title":"Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery","type":"webapps","platform":"jsp","date":"2019-06-05","verified":false,"provenance":"source"},{"id":46967,"url":"https://www.exploit-db.com/exploits/46967","title":"Zimbra < 8.8.11 - XML External Entity Injection / Server-Side Request Forgery","type":"webapps","platform":"jsp","date":"2019-06-05","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":6,"earliest":"2019-04-12"},"pocGithub":{"count":1,"skipped":0,"earliest":"2019-05-06","earliestUrl":"https://github.com/k8gege/ZimbraExploit","repos":[{"name":"k8gege/ZimbraExploit","url":"https://github.com/k8gege/ZimbraExploit","stars":78,"created":"2019-05-06"}]},"metasploit":[{"name":"Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF","module":"exploit/linux/http/zimbra_xxe_rce","type":"exploit","disclosureDate":"2019-03-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb"}],"nuclei":[{"id":"CVE-2019-9621","name":"Zimbra Collaboration Suite - SSRF","severity":"high","path":"http/cves/2019/CVE-2019-9621.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9621.yaml"}],"first":{"date":"2019-03-13","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html","http://packetstormsecurity.com/files/153190/Zimbra-XML-Injection-Server-Side-Request-Forgery.html","http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce","https://www.exploit-db.com/exploits/46693/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1090"],"provenance":"ai"}],"timeline":[{"date":"2019-03-13","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-04-12, PoC-in-GitHub 2019-05-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb","provenance":"source"},{"date":"2019-04-30","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9621","provenance":"source"},{"date":"2023-09-18","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html","provenance":"source"},{"date":"2025-07-07","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-07-07","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-18992","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":2260},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1139 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9963"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"4 NVD references tagged Exploit; 6 Exploit-DB entries; 1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.25,"detail":"base score 7.5"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}