{"id":"CVE-2019-9670","published":"2019-05-29T22:29:01Z","modified":"2026-06-17T02:44:09Z","title":"Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity Reference","vendor":"Synacor","product":"Zimbra Collaboration Suite (ZCS)","tier":"core","eol":null,"description":{"text":"mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.","provenance":"source","from":"NVD"},"summary":{"text":"The mailboxd component of Synacor Zimbra Collaboration Suite (ZCS) contains an XML External Entity injection flaw, demonstrated through the Autodiscover/Autodiscover.xml endpoint. An attacker with network access can exploit it without authentication or user interaction, using crafted XML input to gain the ability to read, alter, and disrupt data on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:00:48Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99986,"percentile":0.99983,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-01-10","dueDate":"2022-07-10","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-9670","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-07-16","exploitedFirstSeen":"2020-07-16","ransomware":false,"evidence":[{"url":"https://media.defense.gov/2020/Jul/16/2002457639/-1/-1/0/NCSC_APT29_ADVISORY-QUAD-OFFICIAL-20200709-1810.PDF","date":"2020-07-16"},{"url":"https://www.tenable.com/blog/daisy-chaining-how-vulnerabilities-can-be-greater-than-the-sum-of-their-parts","date":"2021-01-21"},{"url":"https://media.defense.gov/2021/Apr/15/2002621240/-1/-1/0/CSA_SVR_TARGETS_US_ALLIES_UOO13234021.PDF","date":"2021-04-15"},{"url":"https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf","date":"2021-05-07"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-01-10"},{"url":"https://cisa.gov/news-events/alerts/2022/01/11/understanding-and-mitigating-russian-state-sponsored-cyber-threats-us","date":"2022-03-01"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-011a","date":"2022-03-01"},{"url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-011a","date":"2022-03-01"},{"url":"https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-enterprise-applications-honeypot-unveiling-findings-from-six-worldwide-locations/","date":"2023-07-05"},{"url":"https://www.trendmicro.com/en_us/research/23/i/earth-lusca-employs-new-linux-backdoor.html","date":"2023-09-18"}],"evidenceTotal":1011,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-611","name":"Improper Restriction of XML External Entity Reference"}],"references":[{"url":"http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce","tags":["Third Party Advisory"]},{"url":"https://bugzilla.zimbra.com/show_bug.cgi?id=109129","tags":["Broken Link","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/","tags":["Exploit","Third Party Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46693/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.rapid7.com/db/modules/exploit/linux/http/zimbra_xxe_rce","tags":["Third Party Advisory"]},{"url":"https://bugzilla.zimbra.com/show_bug.cgi?id=109129","tags":["Broken Link","Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/","tags":["Exploit","Third Party Advisory"]},{"url":"https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories","tags":["Vendor Advisory"]},{"url":"https://www.exploit-db.com/exploits/46693/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-9670","tags":["US Government Resource"]}],"techniques":[{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: XXE enables reading local server files","mappingType":"uncategorized","evidence":[{"from":"description","quote":"has an XML External Entity injection (XXE) vulnerability","start":80,"end":136}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1552.001","name":"Credentials In Files","tactics":["credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated web endpoint XXE, public-facing application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml","start":87,"end":186}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-8b6e5f3c2592261e3f88","title":"Advisory further TTPs associated with SVR cyber actors","publisher":"ncsc.gov.uk","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf","date":null,"mentions":[{"quote":"• CVE-2019-9670 Zimbra","start":2691,"end":2713}]},{"id":"SRC-6a1b1e8f3a7b99e55bf0","title":"Advisory: APT29 targets","publisher":"ncsc.gov.uk","url":"https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf","date":null,"mentions":[{"quote":"• CVE-2019-9670 Zimbra [3]","start":3216,"end":3242},{"quote":"[3] https://nvd.nist.gov/vuln/detail/CVE-2019-9670","start":21345,"end":21395}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-19036","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19036","exploited":true,"exploitedSince":"2022-01-10","provenance":"source"},"exploits":[{"id":46693,"url":"https://www.exploit-db.com/exploits/46693","title":"Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)","type":"remote","platform":"linux","date":"2019-04-12","verified":true,"provenance":"source"},{"id":46693,"url":"https://www.exploit-db.com/exploits/46693","title":"Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)","type":"remote","platform":"linux","date":"2019-04-12","verified":true,"provenance":"source"},{"id":46693,"url":"https://www.exploit-db.com/exploits/46693","title":"Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)","type":"remote","platform":"linux","date":"2019-04-12","verified":true,"provenance":"source"},{"id":46693,"url":"https://www.exploit-db.com/exploits/46693","title":"Zimbra Collaboration - Autodiscover Servlet XXE and ProxyServlet SSRF (Metasploit)","type":"remote","platform":"linux","date":"2019-04-12","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2019-04-12"},"pocGithub":{"count":3,"skipped":0,"earliest":"2019-08-16","earliestUrl":"https://github.com/rek7/Zimbra-RCE","repos":[{"name":"rek7/Zimbra-RCE","url":"https://github.com/rek7/Zimbra-RCE","stars":26,"created":"2019-08-16"},{"name":"attackgithub/Zimbra-RCE","url":"https://github.com/attackgithub/Zimbra-RCE","stars":1,"created":"2019-08-16"},{"name":"Cappricio-Securities/CVE-2019-9670","url":"https://github.com/Cappricio-Securities/CVE-2019-9670","stars":0,"created":"2024-04-24"}]},"metasploit":[{"name":"Zimbra Collaboration Autodiscover Servlet XXE and ProxyServlet SSRF","module":"exploit/linux/http/zimbra_xxe_rce","type":"exploit","disclosureDate":"2019-03-13","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb"}],"nuclei":[{"id":"CVE-2019-9670","name":"Synacor Zimbra Collaboration <8.7.11p10 - XML External Entity Injection","severity":"critical","path":"http/cves/2019/CVE-2019-9670.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-9670.yaml"}],"first":{"date":"2019-03-13","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/152487/Zimbra-Collaboration-Autodiscover-Servlet-XXE-ProxyServlet-SSRF.html","https://isc.sans.edu/forums/diary/CVE20199670+Zimbra+Collaboration+Suite+XXE+vulnerability/27570/","https://www.exploit-db.com/exploits/46693/"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"related","techniques":["T1005"],"provenance":"source"},{"stage":"related","techniques":["T1552.001"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2019-03-13","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-04-12, PoC-in-GitHub 2019-08-16","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/zimbra_xxe_rce.rb","provenance":"source"},{"date":"2019-05-29","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9670","provenance":"source"},{"date":"2020-07-16","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://media.defense.gov/2020/Jul/16/2002457639/-1/-1/0/NCSC_APT29_ADVISORY-QUAD-OFFICIAL-20200709-1810.PDF","provenance":"source"},{"date":"2022-01-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-01-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-19036","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":957},"priority":{"score":76.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2297 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 4 Exploit-DB entries; 3 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}