CVE-2024-27442
Vulnerability from cvelistv5
Published
2024-08-12 00:00
Modified
2024-08-13 14:44
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation.
References
cve@mitre.orghttps://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_FixesRelease Notes
cve@mitre.orghttps://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_FixesRelease Notes
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:zimbra:collaboration:9.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "collaboration",
            "vendor": "zimbra",
            "versions": [
              {
                "status": "affected",
                "version": "9.0"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:zimbra:collaboration:10.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "collaboration",
            "vendor": "zimbra",
            "versions": [
              {
                "status": "affected",
                "version": "10.0"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-27442",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-13T14:18:27.711384Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-13T14:44:13.521Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-08-12T14:58:03.586556",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes"
        },
        {
          "url": "https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2024-27442",
    "datePublished": "2024-08-12T00:00:00",
    "dateReserved": "2024-02-26T00:00:00",
    "dateUpdated": "2024-08-13T14:44:13.521Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-27442\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2024-08-12T15:15:20.193\",\"lastModified\":\"2024-08-13T17:30:36.833\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation.\"},{\"lang\":\"es\",\"value\":\"Se descubri\u00f3 un problema en Zimbra Collaboration (ZCS) 9.0 y 10.0. El binario zmmailboxdmgr, un componente de ZCS, est\u00e1 manipulado para que lo ejecute el usuario de zimbra con privilegios de root para operaciones espec\u00edficas del buz\u00f3n. Sin embargo, un atacante puede escalar privilegios del usuario de zimbra al root debido al manejo inadecuado de los argumentos de entrada. Un atacante puede ejecutar comandos arbitrarios con privilegios elevados, lo que lleva a una escalada de privilegios locales.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-755\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-269\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"10.0.0\",\"versionEndExcluding\":\"10.0.7\",\"matchCriteriaId\":\"4CE0029A-44EA-4774-879D-5FA2D35F09BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"685D9652-2934-4C13-8B36-40582C79BFC1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p0:*:*:*:*:*:*\",\"matchCriteriaId\":\"5E4DF01A-1AA9-47E8-82FD-65A02ECA1376\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p1:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDE59185-B917-4A81-8DE4-C65A079F52FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p10:*:*:*:*:*:*\",\"matchCriteriaId\":\"BA3ED95F-95F2-4676-8EAF-B4B9EB64B260\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p11:*:*:*:*:*:*\",\"matchCriteriaId\":\"4BB93336-CC3C-4B7F-B194-7DED036ABBAF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p12:*:*:*:*:*:*\",\"matchCriteriaId\":\"876F1675-F65C-4E86-ADBD-36EB8D8A997D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p13:*:*:*:*:*:*\",\"matchCriteriaId\":\"2306F526-9C56-4A57-AA9B-02F2D6058C97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p14:*:*:*:*:*:*\",\"matchCriteriaId\":\"F9EA2A61-67AA-4B7E-BC6E-80EB1363EF85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p15:*:*:*:*:*:*\",\"matchCriteriaId\":\"C77A35B7-96F6-43A7-A747-C6AEEDE961E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p16:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC35882B-E709-42D8-8800-F1B734CEAFC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p19:*:*:*:*:*:*\",\"matchCriteriaId\":\"B7A47276-F241-4A68-9458-E1481EBDC5E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p2:*:*:*:*:*:*\",\"matchCriteriaId\":\"12D0D469-6C9B-4B66-9581-DC319773238A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p20:*:*:*:*:*:*\",\"matchCriteriaId\":\"40629BEB-DF4B-4FB8-8D3D-7BAC43C90766\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p21:*:*:*:*:*:*\",\"matchCriteriaId\":\"9503131F-CC23-4545-AE9C-9714B287CC25\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p23:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4CE2D12-AD31-4FED-AD0F-ADF64E92E1B1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p24:*:*:*:*:*:*\",\"matchCriteriaId\":\"8113A4E3-AA96-4382-815D-6FD88BA42EC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p24.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC8C28E0-6C51-41EE-A7B2-DB185D1D8FD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p25:*:*:*:*:*:*\",\"matchCriteriaId\":\"BC19F11D-23D9-429D-A957-D67F23A40A01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p26:*:*:*:*:*:*\",\"matchCriteriaId\":\"AAFA2EE7-C965-4F27-8CAE-E607A9F202AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p27:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D09DCF6-1C8F-4CA1-B7D4-AFDD4EB35771\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C52705E6-2C6B-47BC-A0CD-F6AAE0BFC302\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p30:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD1DCE2B-D944-43AE-AD0E-9282DE6D618F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p31:*:*:*:*:*:*\",\"matchCriteriaId\":\"2079B9F8-128B-487D-A965-E8B37FDF6304\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p32:*:*:*:*:*:*\",\"matchCriteriaId\":\"9679FD62-815E-47A8-8552-D28CE48B82B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p33:*:*:*:*:*:*\",\"matchCriteriaId\":\"D659AE6A-591E-4D5B-9781-9648250F5576\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p34:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4054E3E-561C-4B1C-A615-3CCE5CB69D77\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p35:*:*:*:*:*:*\",\"matchCriteriaId\":\"4FA0E9C4-25E4-4CD6-B88A-02B413385866\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p36:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D6F7CA3-C36A-466C-8FAD-D0B3CEF01F0E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p37:*:*:*:*:*:*\",\"matchCriteriaId\":\"9684AC81-B557-4292-8402-AE55CB2E613C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p38:*:*:*:*:*:*\",\"matchCriteriaId\":\"32A352C4-0E9C-436F-ADA7-D93492A18037\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p4:*:*:*:*:*:*\",\"matchCriteriaId\":\"33F50D8C-7027-4A8D-8E95-98C224283772\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p5:*:*:*:*:*:*\",\"matchCriteriaId\":\"82000BA4-1781-4312-A7BD-92EC94D137AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p6:*:*:*:*:*:*\",\"matchCriteriaId\":\"4B52D301-2559-457A-8FFB-F0915299355A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p7:*:*:*:*:*:*\",\"matchCriteriaId\":\"7215AE2C-8A33-4AB9-88D5-7C8CD11E806C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p7.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D859F77-8E39-4D46-BC90-C5C1D805A666\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p8:*:*:*:*:*:*\",\"matchCriteriaId\":\"CDC810C7-45DA-4BDF-9138-2D3B2750243E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zimbra:collaboration:9.0.0:p9:*:*:*:*:*:*\",\"matchCriteriaId\":\"E09D95A4-764D-4E0B-8605-1D94FD548AB2\"}]}]}],\"references\":[{\"url\":\"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-27442\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-08-13T14:18:27.711384Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:zimbra:collaboration:9.0:*:*:*:*:*:*:*\"], \"vendor\": \"zimbra\", \"product\": \"collaboration\", \"versions\": [{\"status\": \"affected\", \"version\": \"9.0\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:a:zimbra:collaboration:10.0:*:*:*:*:*:*:*\"], \"vendor\": \"zimbra\", \"product\": \"collaboration\", \"versions\": [{\"status\": \"affected\", \"version\": \"10.0\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-269\", \"description\": \"CWE-269 Improper Privilege Management\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-08-13T14:44:04.426Z\"}}], \"cna\": {\"affected\": [{\"vendor\": \"n/a\", \"product\": \"n/a\", \"versions\": [{\"status\": \"affected\", \"version\": \"n/a\"}]}], \"references\": [{\"url\": \"https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.7#Security_Fixes\"}, {\"url\": \"https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P39#Security_Fixes\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. The zmmailboxdmgr binary, a component of ZCS, is intended to be executed by the zimbra user with root privileges for specific mailbox operations. However, an attacker can escalate privileges from the zimbra user to root, because of improper handling of input arguments. An attacker can execute arbitrary commands with elevated privileges, leading to local privilege escalation.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"text\", \"description\": \"n/a\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2024-08-12T14:58:03.586556\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-27442\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-13T14:44:13.521Z\", \"dateReserved\": \"2024-02-26T00:00:00\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2024-08-12T00:00:00\", \"assignerShortName\": \"mitre\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.