Zimbra 10.1.20 Patches Critical Security Vulnerabilities
Nine flaws fixed, including a critical SNMP monitoring command injection issue.
1Critical Command Injection Vulnerability
Zimbra 10.1.20 addresses a critical command injection flaw in the SNMP monitoring component. This vulnerability affects systems with SNMP notifications enabled, potentially allowing attackers to execute arbitrary commands. Users are strongly advised to update to the latest version immediately.
2XSS Vulnerabilities and Impacts
The update also fixes multiple cross-site scripting (XSS) vulnerabilities in the Classic Web Client. These flaws could allow malicious scripts to execute via crafted attachment filenames or fields. Attackers could exploit these to access user sessions or sensitive data.
3Email Forwarding Restriction Bypass
Version 10.1.20 resolves an issue where authenticated users could bypass email forwarding restrictions, potentially exfiltrating emails despite configured policies. This posed a significant risk for corporate data leaks and required urgent patching.
4EWS and Mailbox Authorization Issues
The release tackles access control problems in the EWS extension and mailbox delegation authorization. These vulnerabilities could let unauthorized users access sensitive data or exceed their permissions—a critical concern for system administrators.
5SSRF Flaw in Nextcloud Integration
Zimbra patched a server-side request forgery (SSRF) vulnerability in its Nextcloud integration. This flaw might enable attackers to access internal network resources or leak sensitive data. Organizations using this integration must update without delay.
6Previous Updates and Continuity
Earlier in July, Zimbra released version 10.1.19 to fix a critical stored XSS flaw in the Classic Web Client. These consistent updates demonstrate Zimbra's commitment to rapid vulnerability remediation. Keeping systems updated remains crucial for all users.
Original article: Security Affairs — Zimbra 10.1.20 ile Kritik Güvenlik Açıkları Kapatıldı