Zimbra Warns of Critical Zero-Day Flaw in Email Software Amid Active Exploitation – Source:thehackernews.com

Jul 14, 2023THNEmail Security / Vulnerability

Zimbra has warned of a critical zero-day security flaw in its email software that has come under active exploitation in the wild.

“A security vulnerability in Zimbra Collaboration Suite Version 8.8.15 that could potentially impact the confidentiality and integrity of your data has surfaced,” the company said in an advisory.

It also said that the issue has been addressed and that it’s expected to be delivered in the July patch release. Additional specifics about the flaw are currently unavailable, although Zimbra said it fixed the issue through input sanitization.

In the interim, it is urging customers to apply a manual fix to eliminate the attack vector –

1. Take a backup of the file /opt/zimbra/jetty/webapps/zimbra/m/momoveto
2. Edit this file and go to line number 40
3. Update the parameter value as:
4. Before the update, the line appeared as:

While the company did not disclose details of active exploitation, Google Threat Analysis Group (TAG) researcher Maddie Stone said it discovered the cross-site scripting (XSS) flaw being abused in the wild as part of a targeted attack. TAG researcher Clément Lecigne has been credited with discovering and reporting the bug.

The disclosure comes as Cisco released patches to remediate a critical flaw in its SD-WAN vManage software (CVE-2023-20214, CVSS score: 9.1) that could allow an unauthenticated, remote attacker to gain read permissions or limited write permissions to the configuration of an affected Cisco SD-WAN vManage instance.

“A successful exploit could allow the attacker to retrieve information from and send information to the configuration of the affected Cisco vManage instance,” the company said. “A successful exploit could allow the attacker to retrieve information from and send information to the configuration of the affected Cisco vManage instance.”

The vulnerability has been addressed in versions 20.6.3.4, 20.6.4.2, 20.6.5.5, 20.9.3.2, 20.10.1.2, and 20.11.1.2. The networking equipment major said it’s not aware of any malicious use of the flaw.

Update

The critical security flaw impacting Zimbra has been assigned the CVE identifier CVE-2023-34192. It carries a CVSS score of 9.0 out of a maximum of 10.

“Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted script to the /h/autoSaveDraft function,” reads the bug description in the NIST’s National Vulnerability Database (NVD).

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.